BugTracker.NET EUVD-2026-94285

Requires a valid authenticated session to BugTracker.NET (PR:L) - any application account able to reach the file download component that accepts a user-supplied filename parameter; exploitation is remote and needs no user interaction (UI:N) or special attack prerequisites (AC:L/AT:N). Limiting factors: the attacker must first obtain or register an account, and the data obtainable is bounded to files readable by the OS account under which the web application runs, so impact scales with that account's filesystem permissions. There is no indication exploitation depends on a non-default configuration; the vulnerable download feature is a core component.

This is a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity attack that requires low-level privileges (PR:L) - i.e., any authenticated application account - and yields high confidentiality impact with no integrity or availability impact, consistent with read-only path traversal (CWE-24). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation; this is a high-ish-CVSS issue whose real-world urgency is tempered by the authentication requirement and the absence of exploitation indicators. The signals are internally consistent - the description (authenticated remote attacker reading files outside the intended directory) matches the vector's PR:L and VC:H/VI:N/VA:N - so there is no vector-versus-description conflict to flag. The practical ceiling on impact is that the attacker can only read files accessible to the service account, so exposure depends on the privileges of the account running BugTracker.NET. Treat as a prioritized patch for internet-exposed or multi-tenant instances, but not a drop-everything KEV-class event absent any exploitation evidence.

An attacker who holds any valid BugTracker.NET account (self-registered or low-privilege) requests a file download and substitutes a traversal sequence (e.g. ../../) in the filename parameter to step outside the intended attachment directory. The server returns the contents of arbitrary files readable by the application's service account, such as configuration files containing database credentials or connection strings. No public exploit code was identified at the time of analysis, and because the flaw requires only low privileges and low attack complexity, exploitation is trivial once an account is obtained.