A critical directory traversal vulnerability in Softsul SAC-NFe allows unauthenticated attackers to access sensitive system files, posing a significant risk to data confidentiality.

This is a path traversal vulnerability located in the download.php script. An unauthenticated attacker can exploit this flaw by submitting a crafted GET request to read files outside of the intended web root directory.

The ability for an unauthenticated user to read arbitrary files from the host system could lead to the exposure of sensitive configuration files, credentials, or proprietary business data. With a CVSS score of 7.5, this high severity vulnerability necessitates immediate attention to prevent unauthorized information disclosure and potential lateral movement within the network.

Immediate Action: Contact the vendor immediately to determine if a security patch is available for SAC-NFe v2.0.02, or restrict access to the download.php endpoint at the web server level.

Proactive Monitoring: Review web server access logs for suspicious GET requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the download.php file.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block directory traversal attempts and path normalization attacks targeting this specific application path.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Given the high CVSS score and the existence of a public proof-of-concept, organizations running Softsul SAC-NFe should treat this vulnerability with high urgency. Administrators must restrict network access to the affected component and coordinate with the vendor to obtain and apply the necessary security updates to mitigate this exposure.