CVE-2026-105157
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A path traversal vulnerability was detected in RainyGao DocSys up to 2.02.85 in the DocController.doGetTmp function of /Doc/doGetTmpFile.do (Document Controller component). Manipulation of the path/fileName arguments leads to path traversal. Remote exploitation is possible and the exploit is publicly disclosed.
Risk Assessment
The vulnerability allows an attacker to read arbitrary files on the server, potentially leading to leakage of sensitive data including configuration and credentials. The project's lack of response increases the risk.
Recommendation
Immediately restrict access to the /Doc/doGetTmpFile.do endpoint, implement file path validation, and consider updating once a patch is available.
Other vulnerabilities in RainyGao DocSys
See all- CVE-2026-105158High
A SQL injection vulnerability was detected in RainyGao DocSys up to 2.02.85 in the BaseController.createDBForMysql function of BaseController.java (Database Management component). Manipulation of the url argument allows SQL injection. The exploit is publicly available and the attack can be executed remotely.
- CVE-2025-11631Medium
A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in /Doc/deleteDoc.do allows manipulation of the path argument. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-11630Medium
A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in the updateRealDoc function of /Doc/uploadDoc.do allows manipulation of the path argument. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS