EIP-2026-102502

This is a technical writeup detailing an unauthenticated path traversal vulnerability in ManageEngine ServiceDesk Plus <= 9.1 build 9110. The vulnerability allows arbitrary file download via the 'fName' parameter in FileDownload.jsp, with SYSTEM privileges on Windows.