A critical vulnerability in Chunghwa Telecom TenderDocTransfer allows unauthenticated remote attackers to perform unauthorized file operations, posing a significant risk of information leakage.

The application lacks Cross-Site Request Forgery (CSRF) protections for its local web server APIs and contains an absolute path traversal flaw, which can be triggered by unauthenticated remote attackers through phishing lures.

The ability for an attacker to perform arbitrary file copy operations leads to unauthorized data access and potential information disclosure of sensitive local files. Given the CVSS score of 7.1, this vulnerability represents a high risk to business confidentiality and system integrity, as attackers can exfiltrate data or disrupt services by maliciously manipulating file paths.

Immediate Action: Upgrade the TenderDocTransfer application to version 0.41.159 or later immediately to resolve the identified API and path traversal vulnerabilities.

Proactive Monitoring: Review application access logs for unusual API requests, specifically those originating from external sources that attempt to interact with local file system paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security policy to restrict access to the local web server APIs and block suspicious cross-origin requests that may indicate CSRF attempts.

Public Exploit Available: Unknown

Organizations utilizing TenderDocTransfer must prioritize the upgrade to version 0.41.159. Until the patch is applied, users should exercise extreme caution regarding phishing emails or websites that might attempt to interact with local application APIs, as this is the primary vector for triggering the vulnerability.