appRain CMF Path Traversal Vulnerability Allowing Unauthorized File Downloads

A path traversal vulnerability has been identified in appRain CMF version 4.0.5. This vulnerability allows authenticated remote users to bypass SecurityManager restrictions and download files from outside the configured document root, provided they have the necessary permissions. The issue arises in the file download functionality, where base64-encoded paths can be exploited to access restricted files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, potentially including application configuration or user data.