The Aranda File Server component writes daily activity logs to a publicly accessible directory with predictable file names. This design flaw allows unauthenticated remote attackers to discover virtual paths of uploaded documents and bypass user‑level access controls to download files containing personal data. The weakness aligns with CWE‑532, as log files are exposed to unauthorized users, and CWE‑377, due to the insecure, deterministic generation of critical information like log paths.

Aranda Software Aranda Service Desk installations using the File Server component prior to version 8.3.12 are affected. The vulnerability exists in the component that stores logs with predictable names in a directory available to anyone with network access.

The CVSS score is 7.5, indicating a moderate to high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker does not need authentication, and the file names are foreseeable, the exploit is straightforward once the target is identified. The ability to retrieve protected documents that contain personally identifiable information elevates the risk level for exposed systems.