PMWeb EUVD-2026-88375

Exploitation requires a reachable PMWeb instance (7.x, 8.x, or 2025.x) exposing the downloader.aspx endpoint over the network; the attacker supplies traversal sequences in the FullFileName or FileName request argument. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or non-default configuration is required against a default deployment - the download handler itself is the vulnerable surface. Practical limits: PMWeb is deployed in specific construction/capital-program organizations rather than broadly, instances are frequently internal or access-restricted, and read scope may be constrained by the application's file-handling and web-server account permissions; no patch exists, so mitigation depends on WAF/traversal filtering or restricting exposure.

Signals are mixed-but-coherent for a low-to-moderate targeted risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy, remote, unauthenticated path traversal, and the E:P (Proof-of-Concept) exploit-maturity plus the description's explicit 'exploit has been made available to the public' confirm public exploit code exists - but this is NOT active-exploitation evidence. There is no CISA KEV listing and no EPSS score in the input, so exploitation is best characterized as opportunistic/targeted rather than mass-scanned. The vendor scored impact very conservatively as VC:L only (I:N/A:N, no scope change), yielding 6.9; that is likely understated for a file downloader that manipulates FullFileName/FileName, since arbitrary file read of application config (connection strings, secrets) or system files typically warrants C:H. The single most important caveat: this is a VulDB-only advisory with an unresponsive vendor, so affected version boundaries within 7.x/8.x/2025.x, the exact reachable file scope, and any authentication gating are unverified. Net: a real but modest priority - patchless, publicly-exploitable, unauthenticated, but confined to a niche construction-management product.

A remote unauthenticated attacker sends a crafted request to downloader.aspx with a manipulated FullFileName or FileName argument containing directory-traversal sequences (e.g. ..\..\web.config) to read files outside the intended download directory. Public exploit code is available (VulDB E:P), lowering the skill bar, and successful reads of web.config or credential files can expose database connection strings and secrets enabling deeper compromise.