CVE-2026-105157: Path Traversal in RainyGao DocSys

This vulnerability in RainyGao DocSys up to version 2.02.85 involves improper validation of the path/fileName parameter in the DocController.doGetTmp function, enabling path traversal attacks. An attacker can remotely exploit this flaw to access files outside the intended directory. The issue was reported to the project early, but no fix or official response has been provided. Public exploit information is available, increasing the risk of exploitation.

Successful exploitation allows an attacker with low privileges to perform path traversal, potentially accessing sensitive files on the server. This could lead to unauthorized disclosure of information. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, restrict access to the vulnerable endpoint where possible and consider implementing web application firewall (WAF) rules to detect and block path traversal attempts targeting the /Doc/doGetTmpFile.do endpoint.