The IoTSharp BlobStorageController.cs component does not enforce authorization, unlike other controllers in the application. Without a global authorization fallback policy, its endpoints are accessible to unauthenticated remote attackers. Unsanitized path and filename parameters allow path traversal, enabling attackers to manipulate files outside the designated blob storage directory. This can lead to arbitrary file operations, including uploading malicious webshells to web-accessible locations, resulting in remote code execution. This vulnerability is tracked as CVE-2026-71262 with a CVSS 3.1 score of 9.8 (critical).

Unauthenticated attackers can access critical file operation endpoints to upload, download, list, modify, or delete arbitrary files on the server. This includes the ability to write files to web-accessible directories, potentially enabling remote code execution through webshells. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

No official patch or fix is currently documented. Since the vulnerability arises from missing authorization and lack of input sanitization, immediate mitigation should include applying the [Authorize] attribute to BlobStorageController.cs endpoints and configuring a global authorization fallback policy in Startup.cs. Additionally, implement strict validation and sanitization of path and filename parameters to prevent path traversal. Monitor vendor advisories for official patches or updates.