UnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint.
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00793·Published 2025-11-25·Fixed in 10.1.15CWE-22