CVE-2026-71262

Name of the Vulnerable Software and Affected Versions IoTSharp (affected versions not specified)

Description The BlobStorageController.cs component lacks the [Authorize] attribute and does not have a global authorization FallbackPolicy configured in Startup.cs. This allows unauthenticated remote attackers to access the 'Upload', 'Download', 'List', 'Modify', and 'Delete' endpoints. Furthermore, the path and filename parameters passed to these endpoints are used without sanitization in the blob.WriteFileAsync() function. This leads to path traversal, enabling attackers to read, write, modify, and delete arbitrary files outside the intended blob storage directory. If web-accessible paths are targeted, this can be leveraged to achieve remote code execution through the upload of a webshell.

Recommendations Apply the [Authorize] attribute to the BlobStorageController.cs or configure a global authorization FallbackPolicy in Startup.cs to prevent unauthenticated access. Sanitize the path and filename parameters used in the blob.WriteFileAsync() function to prevent path traversal. Restrict access to the BlobStorageController.cs endpoints until these fixes are implemented.