TenderDocTransfer by Chunghwa Telecom contains an Arbitrary File Copy and Paste vulnerability due to lack of CSRF protection and an Absolute Path Traversal flaw in its local web server APIs. This allows unauthenticated remote attackers to copy arbitrary files on the user's system and paste them to any location, risking information leakage and potential disk space exhaustion.