CVE-2025-11630 is a medium severity path traversal flaw (CVSS 6.3) in RainyGao DocSys versions up to 2.02.36. The path argument of the file upload handler is not confined to its intended folder. The record gives no fixed version and the vendor did not respond, so limit access and watch for a patch.
What's affected
RainyGao DocSys versions up to 2.02.36 is affected. The record places the flaw in the updateRealDoc function in /Doc/uploadDoc.do (File Upload component), and the path argument is the input that is not constrained. It is classed as CWE-22 (Path Traversal).
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means a network attack of low complexity by a user with a low privilege account. The record adds that the exploit has been made public and may be used.
The record states that the vendor was contacted early about this disclosure but did not respond in any way. It lists no fixed version, so check the DocSys project page for a release newer than 2.02.36.
How to check if you're exposed
Find the version of DocSys you run and compare it with the range in the record, which is up to and including 2.02.36. The version is usually shown on the login or about page, and in the deployed archive name.
Then look at the storage layout. The risk is greatest when the application process can write or delete outside the document store, for example when it runs with broad file system rights. Check which account runs the service:
ps aux | grep -i docsys | head
ls -ld /path/to/docsys/data
Review web server and application logs for requests to the document handler with unexpected path values, such as long sequences of parent folder markers. Missing or altered files in unrelated folders are also worth a look.
What to do now
-
Confirm the version, and note every instance, including test and staging.
-
Run the service as a dedicated low privilege user that can only touch its own data folder.
-
Place the application behind a VPN or an allowlist, and require authentication for every path.
-
Add a web server or proxy rule that rejects path values containing parent folder markers on this handler.
-
Back up the document store offline so that a file removed or overwritten can be restored.
-
Check the DocSys project page and the record for a fix, and plan a migration if the project stays silent.
Why it matters
Path traversal, tracked as CWE-22 (Path Traversal), happens when a program builds a file path from user input and does not check that the result stays inside the intended folder. The user steers the file operation to a location the developer never meant to expose.
Here the affected operation is the file upload, so the impact depends on what the service account can reach. That is why file system permissions matter as much as the code fix. The correct code fix is to resolve the final path, compare it with the allowed base directory, and refuse anything outside it.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog. It does say the exploit is public and that the vendor has been silent.
To see whether a vulnerable package is hiding in your own projects, run the free in-browser dependency scan at gold.safeguard.sh/scan. The Gold directory lists the same advisories alongside affected versions, and reachability analysis helps you rank which findings are actually called by your code.
Quick check
Is this the same bug as the other DocSys CVEs?
No. DocSys has several separate CVEs in the same range, each on a different handler. They share a product and a silent vendor, but each has its own file and function in the record.
What limits the damage?
The rights of the account running the service. If it can only touch its own data folder, a path trick has far less to reach.
Sources
Last reviewed: 19 October 2026.
