Executive brief
DocSys is a document management system. The vulnerability allows authenticated users to upload arbitrary files (such as JSP web shells) to the server, leading to complete compromise of the system. An attacker can execute arbitrary code and take over the server.
Technical details
The /uploadDoc.do endpoint in DocSys v2.02.80 contains insufficient file upload validation. When the 'usage' parameter is provided, the application checks admin permissions but performs no file type or content validation, allowing attackers to upload executable files (e.g., JSP shells) with attacker-controlled filenames. The vulnerability requires authentication but does not restrict file extensions or validate file content. Attackers can upload web shells to attain remote code execution and full server control. No patch status is indicated in available sources.
Affected products
- RainyGao DocSys v2.02.80
Timeline
- 2026-06-16: disclosed: Issue opened on GitHub
- 2026-08-17: advisory: CVE-2026-67678 published