CVE-2026-75328: DocSys Path Traversal Vulnerability

CVE-2026-75328 Overview

CVE-2026-75328 is an arbitrary file read vulnerability in DocSys-master V2.02.85. The flaw resides in the downloadDocEx interface located in src/com/DocSystem/controller/DocController.java. Attackers can abuse this interface to read files outside the intended document directory, exposing sensitive host resources.

The vulnerability falls under path traversal weaknesses [CWE-22] and enables unauthorized disclosure of application, configuration, and system files. Public documentation of the issue has been published on GitHub, which increases the likelihood of opportunistic exploitation against exposed DocSys instances.

Critical Impact
Unauthenticated or low-privileged attackers can read arbitrary files on the DocSys server, potentially leaking credentials, source code, and system configuration.

Affected Products

DocSys-master V2.02.85
DocController.java component (downloadDocEx interface)
Deployments exposing the DocSys web interface to untrusted networks

Discovery Timeline

2026-08-26 - CVE-2026-75328 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75328

Vulnerability Analysis

The downloadDocEx endpoint in DocController.java accepts file path parameters from client requests and passes them to file read operations without sufficient normalization or containment checks. An attacker supplies traversal sequences such as ../ or absolute paths to escape the intended document root. The server then returns the contents of the referenced file to the requester.

Because DocSys is a document management application, the affected interface is a legitimate download route, which broadens the attack surface. Any file readable by the DocSys process user becomes accessible to the attacker, including application configuration files, database credentials, private keys, and operating system files such as /etc/passwd.

Root Cause

The root cause is missing or incomplete canonicalization of user-supplied path input inside the downloadDocEx handler. The controller trusts the requested path and does not enforce that the resolved file remains within the authorized document directory tree.

Attack Vector

Exploitation requires only HTTP access to the downloadDocEx endpoint. An attacker crafts a request whose path parameter contains directory traversal sequences pointing at a target file. The server reads the file and returns it in the download response. Details of the request structure are documented in the public GitHub write-up.

No verified proof-of-concept code is included in this advisory. Refer to the linked reference for technical details of the vulnerable request.

Detection Methods for CVE-2026-75328

Indicators of Compromise

HTTP requests to the downloadDocEx endpoint containing ../, ..\, %2e%2e%2f, or absolute path prefixes such as /etc/ or C:\
Download responses returning non-document file types such as .conf, .xml, .properties, .pem, or shell history files
Repeated downloadDocEx requests from a single source enumerating sensitive paths

Detection Strategies

Deploy web application firewall rules that inspect downloadDocEx parameters for path traversal patterns and encoded variants
Correlate DocSys application logs with file access telemetry to flag reads of files outside the configured document root
Alert on outbound response bodies from DocSys containing well-known sensitive file signatures such as root:x:0:0

Monitoring Recommendations

Enable verbose access logging on the DocSys application and forward logs to a centralized analytics platform
Baseline normal downloadDocEx usage patterns and alert on deviations in path structure or request frequency
Monitor the DocSys process for reads of operating system files it does not require during normal operation

How to Mitigate CVE-2026-75328

Immediate Actions Required

Restrict network exposure of DocSys-master V2.02.85 instances to trusted users behind VPN or reverse proxy authentication
Block requests to the downloadDocEx endpoint that contain traversal sequences at the WAF or reverse proxy layer
Rotate any credentials, API keys, or certificates that may have been readable by the DocSys process

Patch Information

No vendor patch has been referenced in the NVD entry for CVE-2026-75328 at the time of publication. Monitor the DocSys project repository and the public CVE documentation for updated fixes. Until a patch is released, apply the compensating controls listed below.

Workarounds

Run the DocSys service under a dedicated low-privilege user with filesystem access limited to the document repository
Apply mandatory access controls such as AppArmor or SELinux profiles that confine the process to the intended document paths
Disable or remove the downloadDocEx route in deployments that do not require the extended download functionality

bash

# Example nginx reverse proxy filter blocking traversal on the vulnerable endpoint
location ~* /DocSystem/.*downloadDocEx {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e|/etc/|/root/)") {
        return 403;
    }
    proxy_pass http://docsys_backend;
}