CVE-2026-108772: Path Traversal in bleenco abstruse

This vulnerability in bleenco abstruse up to version 2.1.0 involves improper handling of file path arguments in the Cache Endpoint's filepath.Join function within server/api/worker/download_cache.go. The flaw allows remote attackers to perform path traversal by manipulating the File argument, potentially accessing unauthorized file system locations. The vulnerability has been publicly disclosed with exploit code available, but no vendor response or patch has been provided as of the publication date.

Successful exploitation allows remote attackers to traverse directories on the affected system, potentially accessing sensitive files outside intended directories. This could lead to unauthorized information disclosure or other impacts depending on the files accessed. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected service and monitor for suspicious activity related to file access until a patch is released.