CVE-2026-105157: RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation is remote, requires no user interaction, and has low attack complexity.
What is the likely impact if exploitation succeeds?
The issue can expose files through path traversal in the Document Controller endpoint. The reported impact is limited to confidentiality, with low confidentiality impact and no reported integrity or availability impact.
Which versions should be considered exposed?
RainyGao DocSys versions up to and including 2.02.85 are reported as affected. The vulnerable functionality is DocController.doGetTmp in /Doc/doGetTmpFile.do.
Is public exploit information available?
Yes. The vulnerability report states that an exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The available information does not identify a fix. It states that the project was notified through an issue report but had not responded.