CVE-2026-125753 ABP Framework before 10.6.2 and 10.7.0 Path Traversal via Blogging File Endpoints

What is CVE-2026-125753?

CVE-2026-125753 is a high-severity vulnerability in abpframework abp, published on 10 Nov 2026.

Official description

ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.

Weakness: CWE-22

Which versions are affected by CVE-2026-125753?

How do I fix CVE-2026-125753?

No fix has been published for CVE-2026-125753 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-125753 being exploited?

There is no known exploitation of CVE-2026-125753 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-4x2h-f4f8-xjr6, GHSA-jpw7-jxqw-m2cj.