The Aranda File Server (AFS) in Aranda Service Desk prior to version 8.3.12 stores daily activity logs using predictable names in a directory accessible without authentication. This allows attackers to enumerate and access virtual paths to uploaded files, bypassing intended access controls. As a result, sensitive documents containing PII can be downloaded by unauthorized parties. There is no information about available patches or vendor advisories at this time. The vulnerability is publicly disclosed but no known exploits are reported in the wild.

Unauthenticated remote attackers can access sensitive documents containing personally identifiable information by exploiting predictable log file naming and public directory access. This leads to unauthorized disclosure of sensitive data, potentially causing privacy violations and compliance issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public access to the directory storing daily activity logs and implement access controls to prevent unauthorized file downloads.