An issue in the download.php component of SAC‑NFe v2.0.02 allows an attacker to craft a GET request that performs a directory traversal, leading to arbitrary file read. The flaw arises from insufficient validation of the requested file path. An attacker can read any file accessible to the web server process, exposing sensitive configuration, credentials, or code. This vulnerability is identified as a Path Traversal weakness (CWE‑22).

The affected product is SAC‑NFe, specifically version 2.0.02. No vendor information is provided in the public record, but stakeholders using this version should consider it vulnerable until a fix is available.

No CVSS, EPSS, or KEV metrics are reported for this vulnerability. The attack vector is inferred to be remote via an HTTP GET request to the vulnerable endpoint. Exploitation requires network access to the web server hosting SAC‑NFe. Although there is no documented evidence of exploitation, the severity is significant because it permits an attacker to read any file the web server process can access, potentially leading to further compromise.