CVE-2026-28167 describes an unauthenticated arbitrary file download vulnerability in Super Forms versions <= 6.3.315. The flaw allows remote attackers to download arbitrary files from the affected system without requiring authentication. The vulnerability is classified under CWE-22, indicating a path traversal issue. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the affected system, potentially leading to disclosure of sensitive information. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the vulnerable application and monitor for suspicious file download attempts.