Executive brief
DocSys is a document management system. Its image upload interface allows unauthenticated attackers to upload arbitrary files to any location on the server through path traversal, enabling code execution and potential server compromise.
Technical details
The uploadMarkdownPic endpoint in DocController.java (lines 2019-2024) accepts user-supplied imgName and file parameters without validation. The imgName parameter is directly used as a filename (lines 2081-2088) and combined with a path without sanitization, allowing directory traversal sequences (e.g., ../../../../../../../../tmp/). No authentication is required. An attacker can upload arbitrary files with controlled names to arbitrary filesystem locations, such as web-accessible directories, leading to remote code execution. The vulnerability affects DocSys-master V2.02.85 and potentially later versions.
Affected products
- DocSys DocSys V2.02.85
Timeline
- 2026-08-26: disclosed