PT-2026-82305 · Docsys · Docsys
CVE-2026-75413
·
Published
2026-08-26
·
Updated
2026-08-26
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
DocSys version 2.02.80
Description
An unauthenticated attacker can perform an arbitrary file download by accessing the 'downloadDocEx.do' endpoint. The issue occurs through the
targetPath parameter, allowing the retrieval of any file from the system.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Avoid using the
targetPath parameter in the 'downloadDocEx.do' endpoint to minimize the risk of exploitation.Exploit
Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Docsys