In DocSys-master V2.02.85, the downloadDocEx endpoint permits an attacker to read arbitrary files from the server filesystem because the requested path is not properly validated. This flaw allows disclosure of any file accessible to the application process, including configuration files, credentials, or user data, and is recognized as a path traversal weakness (CWE‑22).

The vulnerability is limited to DocSys-master version 2.02.85; the affected code resides in src/com/DocSystem/controller/DocController.java under the downloadDocEx method. No other versions or products are listed as impacted.

Based on the description, the likely attack vector is a remote unauthenticated request to the downloadDocEx interface when it is publicly exposed. The CVSS score of 7.5 indicates high severity, but the EPSS score of <1% suggests that the exploitation probability is low at present. Nonetheless, the vulnerability can be leveraged to read any file accessible to the application process, creating a potential confidentiality breach. The lack of KEV listing indicates no known exploits in the wild, but the path traversal weakness remains a serious risk if the endpoint is reachable without proper controls.