Executive brief
DocSys is a document management system that allows organizations to store and retrieve files. The downloadDocEx interface fails to validate user-supplied file paths, allowing an unauthenticated attacker to read arbitrary files from the server, including sensitive system files like /etc/passwd. This could expose confidential documents, database credentials, and system configuration information.
Technical details
The vulnerability is a path traversal / arbitrary file read flaw in the downloadDocEx interface (DocController.java, lines 3048–3050). The controller accepts user-supplied targetPath and targetName parameters directly from HTTP requests without authentication checks or path validation. These parameters are Base64-decoded (lines 3067–3085) but not verified for directory traversal sequences before being passed to the file reading method in BaseController.java (line 2338), which opens an input stream and returns the file content. An unauthenticated attacker can construct a request with Base64-encoded path traversal sequences (e.g., `../../../etc/passwd`) to read arbitrary files on the server. No authentication is required, and the vulnerability is network-accessible.
Affected products
- DocSys DocSys V2.02.85
Timeline
- 2026-08-26: disclosed