Technical impact
The vulnerability is a path traversal flaw in Zr.Admin.NET’s /common/DownloadFile endpoint. Any authenticated user can craft a request that contains absolute paths or "../" sequences, allowing them to read arbitrary files on the server. Sensitive configuration files such as appsettings and the JwtSettings secret are exposed, which can then be used to forge administrator tokens and elevate privileges. The flaw is a classic case of path manipulation that bypasses intended file boundaries, making it a severe risk to confidentiality and integrity of the system.
Affected Systems
Zr.Admin.NET, developed by izhaorui, is vulnerable in code revisions between commits 0ee1ab8 and eb9228a. Deployments that incorporate this commit range, regardless of the product version label, are at risk. No explicit product version numbers are listed, so any instance running the affected code is potentially compromised.
Risk and Exploitability
The flaw carries a CVSS v3.0 score of 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be logged into the application, so the window of opportunity is limited to authenticated users. However, the exploitation complexity is low: a crafted request to /common/DownloadFile with a malicious path can read any file the application’s process can access. Reading the JwtSettings secret enables token forgery, leading to full administrative control. The low exploitation barrier coupled with high potential impact makes the risk significant for any exposed deployment.
