Vulnerability · Published Oct 11, 2026 · Assigned by VulDB

CVE-2026-108772bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal

Medium 5.3

In plain English

A medium-severity path traversal in abstruse from bleenco. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
bleenco	abstruse	2.02.1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

References

VDB-416553 | bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal vdb-entry, technical-description
VDB-416553 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-108772 | CVE Analysis and Report third-party-advisory
Submit #958032 | bleenco Abstruse v2.1.0 Authentication Bypass, Path Traversal third-party-advisory
https://glacier-tarsal-711.notion.site/abstruse-worker_cache_path_traversal-3d0b25e24b368035a445c1f09b0b34f6?source=copy_link exploit