Description

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-11T23:16:56.743Z",
  "pubdate": "2026-10-11T23:16:56.743Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the bleenco abstruse software, affecting versions up to 2.1.0.\nThe vulnerability resides within the Cache Endpoint, specifically impacting the filepath.Join function located in server/api/worker/download_cache.go.\nBy manipulating the 'File' argument, a remote, unauthenticated attacker can bypass file system restrictions to access or traverse sensitive directories outside the intended cache root.\nThe flaw stems from improper input validation of user-supplied paths, allowing for directory traversal sequences (e.g., ../) to be processed by the file system API.\nSuccessful exploitation allows unauthorized file read or potentially write access depending on the application context, posing a significant risk to data confidentiality and integrity.\nDespite being notified, the vendor has not provided a resolution, and exploit code has been disclosed publicly, increasing the immediate risk of exploitation.",
  "technicalDetails": "The vulnerability is a classic path traversal flaw located in the server/api/worker/download_cache.go file within the bleenco abstruse Cache Endpoint component.\nThe root cause is the insecure use of the 'filepath.Join' function to construct file system paths based on unsanitized user-controlled input provided via the 'File' argument.\nIn the Go programming language, 'filepath.Join' joins path elements using the OS-specific separator but does not automatically prevent directory traversal attacks if the resulting path is not validated against a secure base directory.\nWhen a remote attacker supplies a specially crafted string containing directory traversal sequences (such as '../'), the function resolves these sequences against the intended base directory, allowing access to files located outside the restricted cache directory.\nThe attack flow proceeds as follows: 1) An attacker identifies the cache endpoint exposed via the API. 2) The attacker sends a request to this endpoint containing a 'File' parameter crafted with traversal sequences (e.g., 'File=../../../../etc/passwd'). 3) The server-side application passes this untrusted input directly to 'filepath.Join'. 4) The resulting path points to an arbitrary location on the server's file system. 5) The application, running with the privileges of the abstruse process, attempts to read or manipulate the file at the resolved path, returning the content or performing the operation requested by the attacker.\nThis vulnerability is reachable remotely and does not require prior authentication, significantly lowering the barrier for exploitation. The attack surface is defined by the network exposure of the Cache Endpoint.\nThe post-exploitation impact is severe. An attacker can leverage this primitive to read sensitive configuration files, source code, environment variables containing secrets, or database credentials. Depending on the logic surrounding the file handling, there is potential for arbitrary file access which could lead to full system compromise or facilitate further attacks within the infrastructure."
}