CVE-2026-75328

Deferred Deferred - Pending Action

Arbitrary File Read in DocSys-master V2.02.85

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: MITRE

Description

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75328

EUVD

EUVD-2026-66802

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file read issue in DocSys-master V2.02.85. It exists in the downloadDocEx interface of the DocController.java file. An attacker could exploit this to read sensitive files on the server without proper authorization.

Detection Guidance

I don't know

Check if the DocSys-master V2.02.85 application is running and inspect the downloadDocEx interface in src/com/DocSystem/controller/DocController.java for unusual file access patterns.

Impact Analysis

This vulnerability could allow attackers to access confidential files stored on the server, including sensitive documents, configuration files, or other restricted data. This may lead to data breaches, unauthorized information disclosure, or further attacks on the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal or health-related data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and loss of trust.

Mitigation Strategies

Immediately update DocSys-master to a patched version if available. If no patch exists, restrict network access to the downloadDocEx interface and monitor file read operations closely.

Hi! I’m here to help you understand CVE-2026-75328. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70