In DocSys-master V2.02.85, the downloadDocEx endpoint permits an attacker to read arbitrary files from the server filesystem because the requested path is not properly validated. This flaw allows disclosure of any file accessible to the application process, including configuration files, credentials, or user data, and is recognized as a path traversal weakness (CWE‑22).

The vulnerability is limited to DocSys-master version 2.02.85; the affected code resides in src/com/DocSystem/controller/DocController.java under the downloadDocEx method. No other versions or products are listed as impacted.

Based on the description, it is inferred that the attack vector is remote via an unauthenticated request to the downloadDocEx interface and that the likelihood of exploitation is high when the endpoint is publicly exposed. No formal CVSS or EPSS metrics are available, and the issue is not listed in the CISA KEV catalog, limiting quantitative assessment. Nonetheless, the ability to read arbitrary files poses a serious confidentiality risk. If the downloadDocEx interface is exposed to unauthenticated users, a remote attacker could exploit it without requiring elevated privileges, making the likelihood of abuse comparatively high in exposed deployments.