CVE-2026-75413: DocSys V2.02.80 Auth Bypass Vulnerability

CVE-2026-75413 Overview

CVE-2026-75413 is an unauthenticated arbitrary file download vulnerability in DocSys V2.02.80. The flaw resides in the downloadDocEx.do interface, which fails to enforce authentication and does not validate the targetPath parameter. Remote attackers can retrieve any file readable by the DocSys application process, including configuration files, source code, and sensitive documents. Exploitation requires no credentials and no user interaction, making the interface directly reachable over the network.

Critical Impact
Unauthenticated attackers can download arbitrary files from servers running DocSys V2.02.80 by supplying a crafted targetPath parameter to downloadDocEx.do.

Affected Products

DocSys V2.02.80
DocSys deployments exposing the downloadDocEx.do endpoint
Refer to the GitHub Issue #48 Discussion for reproduction details

Discovery Timeline

2026-08-26 - CVE-2026-75413 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75413

Vulnerability Analysis

DocSys V2.02.80 exposes the downloadDocEx.do endpoint to serve document downloads. The handler accepts a targetPath parameter and returns the referenced file to the caller. Two design failures combine to create the vulnerability. First, the endpoint does not require an authenticated session, so any network-reachable client can invoke it. Second, the handler does not canonicalize or restrict targetPath to the documents directory. An attacker can supply absolute paths or directory traversal sequences to escape the intended file scope. This class of flaw aligns with path traversal weaknesses tracked as CWE-22 and missing authentication issues tracked as CWE-306.

Root Cause

The root cause is insufficient input validation combined with missing authentication on a file-serving interface. The targetPath parameter is treated as a trusted path rather than a constrained identifier resolved against an allow-list. The handler also lacks authorization checks that would restrict downloads to authenticated users with rights to the requested document.

Attack Vector

An attacker sends an HTTP request to downloadDocEx.do with targetPath set to the file they wish to retrieve. Because no session or token is required, the request succeeds directly. Attackers commonly target application configuration files, credential stores, private keys, and database backups. Retrieved contents can be used to escalate access, pivot to internal systems, or exfiltrate document repositories in bulk.

No verified exploit code is published. See the GitHub Issue #48 Discussion for reproduction context.

Detection Methods for CVE-2026-75413

Indicators of Compromise

Requests to downloadDocEx.do containing a targetPath parameter with absolute paths or ../ traversal sequences.
Unauthenticated HTTP requests to the download endpoint from external IP addresses.
Access log entries showing bulk downloads of sensitive filenames such as web.xml, application.properties, or private key files.

Detection Strategies

Inspect web server and application access logs for downloadDocEx.do requests where targetPath references paths outside the designated document directory.
Deploy WAF or reverse-proxy rules that flag path traversal patterns and absolute paths in query strings targeting DocSys.
Correlate download volume by source IP to identify scraping or reconnaissance behavior against the endpoint.

Monitoring Recommendations

Alert on any request to downloadDocEx.do that lacks a valid authenticated session cookie or token.
Monitor for outbound transfers of large numbers of documents originating from the DocSys host within short time windows.
Track process-level file access on the DocSys server for reads of files outside the documents directory.

How to Mitigate CVE-2026-75413

Immediate Actions Required

Restrict network access to the DocSys application, placing it behind a VPN or authenticated reverse proxy until a patch is available.
Block requests to downloadDocEx.do that contain ../, absolute paths, or paths outside the documents root at the WAF layer.
Audit access logs for prior exploitation attempts and rotate any credentials or secrets stored on the DocSys server.

Patch Information

No vendor patch is referenced in the CVE record at the time of publication. Monitor the DocSys GitHub repository and the GitHub Issue #48 Discussion for remediation guidance and upgraded releases.

Workarounds

Enforce authentication in front of DocSys using a reverse proxy that requires SSO or basic auth before requests reach downloadDocEx.do.
Add URL filtering rules that reject requests where targetPath is absolute, contains traversal sequences, or resolves outside the documents directory.
Run the DocSys process under a least-privilege service account that cannot read system configuration files or private keys.

bash

# Example nginx rule to block traversal patterns in targetPath
location /DocSystem/Bussiness/downloadDocEx.do {
    if ($arg_targetPath ~* "(\.\./|\.\.\\|^/|^[A-Za-z]:\\)") {
        return 403;
    }
    proxy_pass http://docsys_backend;
}