bleenco Abstruse CVE-2026-108772

The vulnerable path is the worker Cache Endpoint served by server/api/worker/download_cache.go; exploitation requires only network reachability to that endpoint and control over the 'File' argument, which is passed to filepath.Join without adequate sanitization, allowing ../ traversal. Per the CVSS vector (PR:N/UI:N) the attack is unauthenticated and needs no user interaction against default behavior. Limiting factors: the attacker must be able to reach the Abstruse worker's cache download endpoint over the network (exposure depends on how the CI/CD instance is deployed/firewalled), and impact is limited to reading files (VC:L, no write or execution), so damage is bounded to information disclosure of files readable by the worker process.

This is a path traversal flaw (CWE-22) in the Cache Endpoint of bleenco Abstruse, a niche open-source CI/CD platform, affecting versions up to 2.1.0. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated attack requiring no user interaction, but impact is constrained to low confidentiality only (VC:L) with no integrity or availability impact (VI:N/VA:N) and no scope/subsequent-system effect - consistent with an arbitrary-file-READ rather than code execution. The base score of 6.9 (Medium) is driven mostly by exploitability, not impact. A public exploit exists (VulDB, Notion write-up) and the embedded E:P (Proof-of-Concept exploit maturity) corroborates this, so the vulnerability is realistically reachable; however, there is NO CISA KEV listing and NO EPSS score was provided, meaning there is no evidence of active, widespread exploitation. The vendor was contacted but did not respond, so no official patch or advisory is confirmed. Net: the easy, unauthenticated network reach makes this a genuine concern for anyone running Abstruse, but the low confidentiality-only impact and the product's limited deployment footprint keep real-world priority moderate rather than critical. Note the signals are consistent (POC exists, impact is low) - no contradiction between vector and description.

A remote, unauthenticated attacker sends a crafted request to the Abstruse worker Cache Endpoint, supplying a 'File' parameter containing directory-traversal sequences (e.g. ../../) that defeat the filepath.Join handling in download_cache.go. Because no authentication or user interaction is required, the attacker retrieves files outside the intended cache directory, disclosing sensitive data from the worker host. A public proof-of-concept exploit is already available, lowering the barrier to exploitation.