CVE-2026-71262 Details

A vulnerability exists in the IoTSharp BlobStorageController due to the absence of the [Authorize] attribute, which is applied to other controllers within the application. Additionally, no global authorization FallbackPolicy is set in Startup.cs. This oversight allows unauthenticated remote attackers to access the Upload, Download, List, Modify, and Delete endpoints. The vulnerability is further exacerbated by the lack of parameter sanitization in the path and filename parameters, enabling path traversal attacks that could result in writing, reading, modifying, or deleting arbitrary files outside the designated blob storage directory. This includes web-accessible paths that could be exploited for remote code execution through web shell uploads.

To address this vulnerability, apply the [Authorize] attribute to the BlobStorageController and configure a global authorization FallbackPolicy in Startup.cs. Additionally, implement proper sanitization of the path and filename parameters to prevent path traversal attacks.