CVE-2026-71262
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
05/08/2026
Última modificación:
05/08/2026
Descripción
*** Pendiente de traducción *** IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers. The path/filename parameters passed to these endpoints (e.g. `_blob.WriteFileAsync($"{path}/{formFile.FileName}", ...)`) are used without sanitization, enabling path traversal that allows writing, reading, modifying, and deleting arbitrary files outside the intended blob storage directory, including web-accessible paths that can be leveraged for remote code execution via webshell upload.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA