CVE-2026-75413CWE-552

CVE-2026-75413

High · published August 27, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-08-27T01:16Z
References (2)
https://github.com/RainyGao-GitHub/DocSys/issues/48 · [email protected]https://github.com/RainyGao-GitHub/DocSys/issues/48 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    DocSys V2.02.80 is vulnerable to Any File Download
    cvelistv5