CVE-2026-71262: IoTSharp BlobStorageController Missing Authentication and Path Traversal
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers. The path/filename parameters passed to these endpoints (e.g. blob.WriteFileAsync($"{path}/{formFile.FileName}", ...)) are used without sanitization, enabling path traversal that allows writing, reading, modifying, and deleting arbitrary files outside the intended blob storage directory, including web-accessible paths that can be leveraged for remote code execution via webshell upload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the [Authorize] attribute to BlobStorageController so that Upload/Download/List/Modify/Delete endpoints require authentication, matching other controllers (e.g., DevicesController, CustomersController, TenantsController).
IoTSharp BlobStorageController Authorize attribute on endpoints = [Authorize] - Configuration
Configure a global authorization FallbackPolicy in Startup.cs so unauthenticated requests are denied by default for endpoints that lack explicit [Authorize].
Startup.cs (global authorization) FallbackPolicy = authenticated - Configuration
Sanitize and validate the path and formFile.FileName inputs used in _blob.WriteFileAsync($"{path}/{formFile.FileName}", ...) and corresponding read/modify/delete logic to prevent path traversal and access to files outside the intended blob storage directory.
IoTSharp BlobStorageController.cs path/filename handling (WriteFileAsync/Routed blob path) = sanitize/validate inputs - Compensating control
Ensure the blob storage target directory is not web-accessible (and/or enforce storage access via authenticated APIs only) to reduce the impact of any potential webshell upload through path traversal.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71262?
CVE-2026-71262 has a critical severity score of 9.8.
What are the risks associated with CVE-2026-71262?
CVE-2026-71262 allows unauthorized access and potentially harmful path traversal to the BlobStorageController.
How do I fix CVE-2026-71262?
To fix CVE-2026-71262, apply the [Authorize] attribute to the BlobStorageController and configure a global authorization FallbackPolicy in Startup.cs.
What might happen if CVE-2026-71262 is exploited?
If CVE-2026-71262 is exploited, an attacker could upload, download, list, or modify resources without authorization.
Which versions of IoTSharp are affected by CVE-2026-71262?
CVE-2026-71262 affects all versions of IoTSharp that have the vulnerable BlobStorageController configuration.