Executive brief
DocSys is a document management system. The application contains an unauthenticated file download vulnerability in the downloadDocEx endpoint that allows attackers to read and download any file from the server by manipulating path parameters. This could expose sensitive data including configuration files, credentials, and other business-critical documents without requiring login.
Technical details
DocSys V2.02.80 is vulnerable to arbitrary file download through the downloadDocEx.do interface. The vulnerability exists in DocController.java where the application accepts targetPath and targetName parameters without proper validation or access control. The parameters are base64-decoded and directly concatenated to construct a file path, with no filtering or directory traversal protection. An attacker can craft a request with base64-encoded path traversal sequences to download any file readable by the application process. The vulnerability requires only knowledge of the target file path and does not require authentication.
Affected products
- RainyGao DocSys 2.02.80
Timeline
- 2026-06-15: disclosed: Vulnerability reported on GitHub
- 2026-08-26: advisory: CVE-2026-75413 published