CVE-2026-71262 affects IoTSharp's BlobStorageController.cs, which lacks the [Authorize] attribute present on all other controllers in the application. No global authorization FallbackPolicy is configured in Startup.cs, leaving Upload, Download, List, Modify, and Delete endpoints fully accessible to unauthenticated remote attackers. Additionally, path and filename parameters passed to these endpoints are used without sanitization, enabling path traversal attacks. Attackers can read, write, modify, and delete arbitrary files outside the intended blob storage directory. Web-accessible paths can be targeted, allowing attackers to upload webshells and achieve remote code execution. This combination of missing authentication and unsanitized input represents a critical security flaw in the IoTSharp platform.