Arbitrary file disclosure via unfiltered log filename

Path traversal in ECOA BAS controllers allows remote attackers to read arbitrary files through an unauthenticated POST request. The log-viewing function accepts a filename parameter without filtering traversal characters, so crafted paths escape the intended directory and select sensitive system files. No login is required; the demonstrated consequence is disclosure of device and system information, with no reported file modification or service interruption.