The vsDesk application generates uploaded file names using a timestamp‑based scheme that is weak and predictable. Because the filenames can be accurately guessed or brute‑forced within a short time window, an attacker can locate and read uploaded files before the application attempts to delete or move them. This remote file access can be leveraged to facilitate additional attacks, such as exfiltration of sensitive data or chaining to other vulnerabilities. The weakness is consistent with CWE-340 (Predictable Value) and CWE-377 (Timestamp Dependency).

All installations running vsDesk versions older than 14.0101 are affected. The vendor has released a patch for version 14.0101 and any later releases that addresses the filename generation flaw.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation today. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker can guess the filename by observing the time of upload or by rapid brute‑force attempts, thereby gaining read access to the file without needing privileged credentials. Consequently, the risk is moderate but exploitable in environments that expose the upload directory to the public internet.