Path Traversal Vulnerability in ABP Framework by ABP

CVE-2026-125753

What is CVE-2026-125753?

The ABP Framework prior to version 10.6.2 and pre-release 10.7.0 contains a critical path traversal flaw in the DefaultBlobFilePathCalculator component. This vulnerability allows unauthorized attackers to exploit the Blogging API to send specially crafted requests containing encoded backslashes. As a result, they can bypass directory restrictions and traverse the file system to gain access to sensitive files outside the designated blob container, such as appsettings.json, which may expose critical application secrets like signing keys and connection strings.

References