Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71262: IoTSharp BlobStorageController lacks authentication, allowing unauthorized access
CVE-2026-71262
Summary
The IoTSharp BlobStorageController is not secure because it doesn't require authentication, making it accessible to anyone. This can lead to unauthorized access to and manipulation of files, potentially allowing attackers to execute code on the server. To fix this, add the [Authorize] attribute to the controller and configure global authorization in the Startup.cs file.
Original title
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no glob...
Original description
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers. The path/filename parameters passed to these endpoints (e.g. `_blob.WriteFileAsync($"{path}/{formFile.FileName}", ...)`) are used without sanitization, enabling path traversal that allows writing, reading, modifying, and deleting arbitrary files outside the intended blob storage directory, including web-accessible paths that can be leveraged for remote code execution via webshell upload.
nvd CVSS3.1
9.8
Vulnerability type
CWE-306
Missing Authentication for Critical Function
Published: 5 Aug 2026 · Updated: 5 Aug 2026 · First seen: 5 Aug 2026