Description

Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T12:16:50.850Z",
  "pubdate": "2026-08-24T12:16:50.850Z",
  "executiveSummary": "An unauthenticated arbitrary file download vulnerability exists in Super Forms versions 6.3.315 and prior.\nThis security flaw allows unauthenticated remote attackers to retrieve arbitrary files from the underlying server hosting the vulnerable application.\nThe vulnerability exposes sensitive system files, configuration data, and application source code, posing severe risk implications such as full system compromise and exposure of credentials.\nAttackers do not require prior authentication or elevated privileges to exploit this flaw, significantly lowering the barrier for exploitation.\nSuccessful exploitation relies on network connectivity to the target running the affected Super Forms software, allowing unauthorized actors to interact with vulnerable endpoints and extract restricted files via crafted requests.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper path sanitization within the file handling mechanisms of the Super Forms plugin.\nSpecifically, the affected component fails to adequately restrict user-supplied input utilized in file retrieval operations, enabling directory traversal techniques and arbitrary file access.\nThe affected product is Super Forms, specifically targeting versions 6.3.315 and earlier.\nThe vulnerability is exposed over the network, allowing remote attackers to dispatch malicious HTTP requests directly to the application without requiring any prior authentication or specific user privileges.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts an HTTP request containing directory traversal sequences (such as dot-dot-slash) combined with target file paths directed toward the vulnerable Super Forms endpoint.\nUpon receiving the request, the vulnerable component processes the input without proper validation or boundary checks, resolving the path to sensitive files residing outside the intended web root.\nThe application then reads the targeted file and returns its contents within the HTTP response body to the attacker.\nPost-exploitation impact includes the potential unauthorized disclosure of critical system configuration files, database credentials, environment variables, and source code, which can be leveraged by the attacker to facilitate subsequent attacks, lateral movement, or complete system takeover."
}