Path Traversal Vulnerability in Zr.Admin.NET Affects File Security
CVE-2026-129464

8.7HIGH

Key Information:

Vendor

Izhaorui

Status
Zr.admin.net
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129464?

The vulnerability in Zr.Admin.NET allows authenticated users to exploit a path traversal flaw through the '/common/DownloadFile' endpoint, enabling them to read arbitrary server files. By manipulating the path parameter with absolute paths or using '../' sequences, attackers can gain unauthorized access to sensitive configuration files, including appsettings, which may expose critical data like the JwtSettings SecretKey. This could lead to serious security implications, such as the forging of administrator tokens.

Affected Version(s)

Zr.Admin.NET 0ee1ab8af5e3861766746d25acba1184111befcb

References

https://vul.yulun.ac.cn/20261114/zr-admin-net/
third-party-advisory
https://github.com/izhaorui/Zr.Admin.NET/issues/27
issue-tracking
https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a2301...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.