CVE-2026-129464: Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile
Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it. The vulnerable endpoint is /common/DownloadFile, and exploitation requires supplying a crafted path parameter.
What access can an attacker obtain through the vulnerable endpoint?
An attacker can read arbitrary files from the server by using absolute paths or ../ traversal sequences. This includes application configuration files such as appsettings files.
Why does exposure of appsettings files increase the impact?
If an attacker obtains the JwtSettings SecretKey from an appsettings file, they can forge administrator tokens. This can lead to administrator-level access in addition to server file disclosure.
Which source revisions are affected?
The affected range is commit 0ee1ab8 through commit eb9228a. Deployments using code within that range should be treated as vulnerable.