TenderDocTransfer by Chunghwa Telecom contains an arbitrary file delete vulnerability due to lack of CSRF protection and an absolute path traversal flaw in its local web server APIs. This allows unauthenticated remote attackers to delete arbitrary files on the user's system via phishing attacks.