CVE-2026-105157 RainyGao CVE debrief

Who should care

Defenders responsible for RainyGao DocSys deployments should assess exposure and prioritize verification of affected versions. This includes reviewing and restricting access to the /Doc/doGetTmpFile.do component, monitoring for potential exploitation attempts, and verifying the version of RainyGao DocSys in use. Security teams and vulnerability management teams should also review the CVE record and NVD entry for additional details on the vulnerability.

Why it matters

A path traversal vulnerability in RainyGao DocSys up to 2.02.85 allows for remote exploitation, requiring defenders to verify affected versions and assess exposure.

• Verify the version of RainyGao DocSys in use and assess exposure
• Review and restrict access to the /Doc/doGetTmpFile.do component
• Monitor for potential exploitation attempts

Technical summary

The vulnerability is located in the DocController.doGetTmp function of the /Doc/doGetTmpFile.do component in RainyGao DocSys up to 2.02.85. The manipulation of the path/fileName argument leads to path traversal, allowing for remote exploitation. This vulnerability requires defenders to verify affected versions and assess exposure in their environments. Additional review of the component and its access controls is necessary to prevent exploitation. The vulnerability has a CVSS score of 2.1 and is considered low severity.

Defensive priority

Defenders should prioritize verifying the affected versions and assessing exposure in their environments.

Recommended defensive actions

• Verify the version of RainyGao DocSys in use and assess exposure
• Review and restrict access to the /Doc/doGetTmpFile.do component
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected components. However, the vendor's response and remediation efforts are unknown. Defenders should verify the affected versions and assess exposure in their environments. The exploit has been publicly disclosed but may not be used. The project was informed but has not responded yet. Additional review of the /Doc/doGetTmpFile.do component is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.