CodeFever EUVD-2026-109713

Exploitation targets the documentation feature: the _detail handler in application/controllers/doc.php builds a filesystem path from the attacker-controlled uri_string without a canonicalization/boundary check, so manipulating that argument with traversal sequences lets a request escape the intended dirname(APPPATH)/doc/<docPath> root. Per the CVSS vector (AV:N/PR:N/UI:N) the attack is remote and requires no authentication or user interaction against a default-configured instance that exposes the /doc routes. Limiting factors: impact is read-only information disclosure (VC:L; no integrity/availability effect), the vulnerable code path is the documentation controller, and the fix constrains resolved paths to the doc root via realpath and enforces .md/.png extension patterns - confirming the pre-patch exposure was reachable through normal document/menu/image resolution rather than requiring special configuration.

This is a moderate-severity, limited-impact issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but the impact is confined to confidentiality at Low (VC:L; VI:N/VA:N), consistent with a path-traversal file-read in the documentation controller. Exploit maturity in the vector is E:P (proof-of-concept), and the multi-source intelligence lists the PoC as a reference only, not verified as working exploit code - so a public PoC reference exists, but it is not confirmed as functioning exploit code. There is no CISA KEV listing and no EPSS score in the provided data, so widespread or automated exploitation cannot be asserted; the absence of EPSS/KEV is a data gap, not evidence of safety. The vendor's priority signal is this_month (not act_now/emergency), which aligns with the low confidentiality-only impact and niche product. Net: a genuine but low-urgency remote information-disclosure issue - patch on a normal maintenance cycle rather than as a fire drill, while recognizing the low attack barrier means it is easy to attempt if a working exploit is produced.

A remote, unauthenticated attacker sends a crafted request to the documentation endpoint handled by doc.php, placing traversal sequences in the uri_string argument so the URI sanitizer resolves a path outside the intended doc root. The server then returns the contents of a file it should not expose, yielding information disclosure. A public PoC reference exists but is not verified as working exploit code, so real-world reliability is unconfirmed.