EUVD-2026-92097
GHSA-6wm8-mcq6-fgm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted request to /Doc/doGetTmpFile.do
-
ExecutionInject traversal sequence in path/fileName
-
ImpactRead arbitrary file outside temp directory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the DocSys Document Controller endpoint /Doc/doGetTmpFile.do over the network and to supply a traversal payload in the path/fileName argument of the DocController.doGetTmp function. The CVSS PR:L metric indicates a valid low-privileged authenticated session is required - it is NOT unauthenticated. No user interaction is needed (UI:N) and no special non-default configuration is called out in the description. Limiting factors: the authentication requirement, the confidentiality-only impact (file read, not write or code execution), and the niche deployment of DocSys all constrain realistic risk despite the network attack vector. |
| Impact | The signals converge on a LOW-to-MODERATE real-world risk rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack but explicitly requires low-level privileges (PR:L), and impact is confined to confidentiality only (VC:L; VI:N, VA:N) - consistent with reading arbitrary files via path traversal rather than code execution or data modification. The base score of 5.3 (Medium) and E:P (Proof-of-Concept exploit maturity) reflect that a public POC exists but exploitation is not yet automated or widespread. There is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or probable exploitation. The one notable amplifier is that the vendor was notified early via a Gitee issue but has not responded, meaning no patch is expected soon - an unpatched Medium flaw with public POC. On balance this is a 'moderate-severity, public-POC, unpatched, but low-footprint and authentication-gated' issue, not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged DocSys account sends a crafted request to /Doc/doGetTmpFile.do manipulating the path/fileName parameter with directory-traversal sequences (e.g. ../../) to read files outside the intended temporary-file directory. A public proof-of-concept exists (disclosed via the vendor's Gitee issue tracker), lowering the skill barrier, though the confidentiality-only impact limits the outcome to unauthorized file disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 04, 2026
Arbitrary file read via path traversal in RainyGao DocSys through version 2.02.85 lets an authenticated, low-privileged remote attacker read files outside the intended document directory by supplying crafted path/fileName values to the /Doc/doGetTmpFile.do endpoint handled by DocController.doGetTmp; publicly available exploit code exists and the vendor has not responded to the issue report. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the confidentiality-only, read-only impact and the requirement for a valid low-privileged session, so this is a LOW-to-MODERATE risk rather than an urgent priority, with no confirmed active exploitation (CISA KEV is not applicable) and deployment of DocSys being niche.
RemediationAI
No vendor-released patch identified at time of analysis - the project was notified through the Gitee issue https://gitee.com/RainyGao/DocSys/issues/IKA7W8 but has not responded - so operators should first attempt to contact the maintainer and then apply compensating controls: front the application with a reverse proxy or WAF rule that rejects requests to /Doc/doGetTmpFile.do containing traversal sequences in the path or fileName parameters (accepting possible false positives on legitimate filenames with unusual characters), restrict network access to that endpoint to trusted administrative networks or disable the temporary-file retrieval feature entirely if it is not required by business workflows (removing functionality that some document workflows may depend on), run the DocSys service under a dedicated low-privilege OS account with read access limited to the document storage root so that any successful traversal yields minimal information, and monitor logs for anomalous ../ patterns or unexpected file paths requested via doGetTmpFile.do; continue to track the VulDB entries at https://vuldb.com/vuln/413376 and https://vuldb.com/cve/CVE-2026-105157 for a future fixed release and upgrade as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory: the Document Controller in RainyGao DocSys exposes /Doc/doGetTmpFile.do, whose DocController.doGetTmp method takes caller-controlled path and fileName arguments and uses them in filesystem operations without adequate canonicalization or containment checks, allowing sequences such as ../ to escape the intended temporary-file root. CPE data (cpe:2.3:a:rainygao:docsys:*:*:*:*:*:*:*:*) marks the whole product line up to and including 2.02.85 as affected, and the CVSS:4.0 base score of 5.3 with E:P reflects a medium-severity issue that already has public proof-of-concept material; our independent 3.1 assessment narrows the vector to PR:L, meaning the attacker must already hold a low-privileged authenticated session, and limits impact to confidentiality only (VC:L) with no write, integrity, or availability effect.
Know when Docsys gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable traversal needing a low-privileged account (PR:L), low complexity (AC:L); yields limited file disclosure so C:L with I:N and A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
A vulnerability has been found in RainyGao DocSys and classified as critical. Rated high severity (CVSS 7.5), this vulne
SQL injection in RainyGao DocSys (up to version 2.02.85) allows an attacker to inject arbitrary SQL through the 'url' ar
A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. Rated high severity (CVSS 7.2), this v
Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the 'path' p
Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the path arg
SQL injection in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to execute arbitrary SQL qu
A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSys
Docsys versions up to 2.02.36. contains a vulnerability that allows attackers to sql injection (CVSS 6.3).
A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file s
Exploit-DB