DocSys CVE-2026-75328

No authentication is required - the CVSS vector PR:N confirms unauthenticated access. The downloadDocEx endpoint must be network-reachable (no non-default configuration required; this is core document download functionality). Exploitation is constrained by the OS-level file permissions of the Java process user: only files readable by that OS account are accessible. No user interaction is required (UI:N). Exploitation is limited to read operations - no write, code execution, or availability impact is possible through this vector alone. The product must be version V2.02.85; other versions are not confirmed vulnerable from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterizes this as unauthenticated, low-complexity, remotely exploitable with high confidentiality impact - a severe attack surface on paper. However, EPSS at 0.14% (4th percentile) sharply contrasts with SSVC's finding of poc-level exploitation and automatable delivery, suggesting the PoC is public but has not driven mass scanning campaigns, most plausibly because DocSys-master has a very limited production footprint. No CISA KEV listing is present, so active exploitation is not confirmed. The confidentiality-only blast radius (I:N/A:N) means attackers can read files but cannot modify data or disrupt availability. The primary real-world risk is credential and configuration file exfiltration from the server OS user's accessible filesystem. The CVSS-versus-EPSS divergence is notable: prioritize remediation only in environments where DocSys is internet-exposed or handles sensitive documents.

An unauthenticated remote attacker sends an HTTP request to the publicly accessible downloadDocEx endpoint with a crafted filename parameter such as '../../../../etc/passwd' or '../../../../WEB-INF/web.xml'. The server, lacking path validation, reads and returns the file contents directly. A publicly available PoC on GitHub demonstrates this technique against V2.02.85.