Bimser eBA Plus EUVD-2026-88173

Requires a valid authenticated session on the eBA Plus Document and Workflow Management System at a low privilege level (PR:L) - exploitation is remote over the network (AV:N) with low complexity (AC:L) and no user interaction. The specific vulnerable feature/endpoint is not named in the advisory, but the flaw affects versions from 6.7.141 up to (not including) 10.0.11; deployments on 10.0.11 or later are not affected. The limiting factor is the authentication prerequisite: an attacker must possess or obtain low-privilege credentials, so purely anonymous exploitation is not indicated by the CVSS vector.

This is a moderate-severity, credentialed information-disclosure issue rather than a top-priority emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent with a path-traversal (CWE-22) flaw that lets an already-authenticated, low-privileged user read arbitrary files on the server (C:H) with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is currently no evidence of active or automated exploitation - the sole reference is a TR-CERT (Turkish national CERT) advisory. The requirement for valid low-privilege credentials (PR:L) meaningfully constrains the attacker population versus a fully unauthenticated flaw, but network reachability (AV:N) and low complexity (AC:L) mean any authenticated user or a compromised low-level account could exploit it easily. Net: real but bounded - patch as part of normal prioritized maintenance, escalated if the deployment exposes sensitive documents (likely, given it is a document-management system). Note the absence of EPSS/POC data does not prove low risk, only that no widespread exploitation is yet observed.

An authenticated low-privilege user of the eBA Plus web application sends a crafted request whose file/path parameter contains directory-traversal sequences (e.g., ../../), causing the server to return files outside the intended document directory. This can disclose configuration files, credentials, or other users' documents. No public exploit code is identified at time of analysis; exploitation requires only valid low-level credentials and knowledge of the vulnerable endpoint.