Chunghwa Telecom TenderDocTransfer is vulnerable to arbitrary file deletion, posing a significant risk of system instability and data loss through unauthenticated remote exploitation.

The application lacks Cross-Site Request Forgery (CSRF) protection on its local web server APIs, which, combined with an absolute path traversal flaw, allows an unauthenticated attacker to delete arbitrary files on the host system.

The ability for an unauthenticated attacker to delete arbitrary files on the host system creates a severe risk of service disruption, loss of critical business data, or total system compromise. With a CVSS score of 8.1, this vulnerability is classified as High, reflecting the potential for significant operational impact if the application is used to manage sensitive documents or system configurations.

Immediate Action: Update the TenderDocTransfer software to version 0.41.159 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unauthorized API requests or unusual file deletion patterns, particularly those originating from user web browsers.

Compensating Controls: Implement strict network access controls to limit access to the local web server APIs and utilize a web application firewall to block suspicious cross-site requests.

Public Exploit Available: Unknown

The combination of CSRF and path traversal in TenderDocTransfer presents a high-risk scenario that must be addressed promptly. Organizations should prioritize updating to version 0.41.159 to eliminate the underlying vulnerability and prevent potential remote file deletion attacks.