CVE-2026-129464

The Zr.Admin.NET framework (commits 0ee1ab8 through eb9228a ) is vulnerable to a path traversal vulnerability in the /common/DownloadFile endpoint. This flaw allows any authenticated user to read arbitrary server files by supplying absolute paths or ../ sequences via the path parameter. A practic...

EUVD-2026-125956

Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the...

PT-2026-147447

Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the...

CVE-2026-129464: izhaorui Zr.Admin.NET: Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in…

Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the...