{"id":"EM-20261111-W7UI","url":"https://cyber.eventmonitor.net/incident/EM-20261111-W7UI/abp-framework-vulnerability-cve-2026-125753/","type":"cve","title":"ABP Framework Vulnerability (CVE-2026-125753)","subtitle":"CVE-2026-125753","subject":"CVE-2026-125753","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-11T07:21:55.000Z","firstSignal":"2026-11-10T16:17:22.307Z","lastSignal":"2026-11-11T07:21:55.000Z","updated":"2026-11-11T15:44:07.320Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T07:21:55.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-11T07:21:55.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T16:17:22.307Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T07:21:55.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261111-W7UI created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T16:17:22.307Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T16:17:22.307Z","detail":"CVSS 8.2"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T16:17:22.307Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-125753 (CVSS 8.2)","text":"ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125753"},{"at":"2026-11-11T07:21:55.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-125753","text":"# CVE-2026-125753 — path traversal out of the blob container in ABP Framework\n\n![CVE](https://img.shields.io/badge/CVE-2026--125753-b00?style=flat-square)\n![CVSS 4.0](https://img.shields.io/badge/CVSS_4.0-8.2_High-fe7d37?style=flat-square)\n![CWE](https://img.shields.io/badge/CWE--22-path_traversal…","url":"https://github.com/yuwkaaa/CVE-2026-125753"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T16:17:22.307","score":8.2,"severity":"HIGH","desc":"ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging…","product":"","seen":1794338539165},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}