Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-105157: RainyGao DocSys lets attackers retrieve unauthorized files
CVE-2026-105157 · published 14 days ago
Summary
The Document Controller feature in RainyGao DocSys (versions up to 2.02.85) can be tricked into reading files from anywhere on the server by supplying a specially crafted file name. This could let an external user view sensitive system or application files, potentially exposing private data. Apply the vendor's patch or update to a fixed version as soon as possible, and limit direct access to the DocController endpoint until then.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rainygao | docsys | 2.02.0 |
Original advisory text
RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta