Unauthenticated file disclosure via path traversal

Path traversal in CAREL Boss Mini 1.4.0 Build 6221 allows remote attackers on the same network segment to read sensitive files. The /boss/servlet/document endpoint uses the attacker-controlled path argument to select filesystem resources without confining resolution to an authorized directory. No authentication or user interaction is required; exposure is limited to devices reachable from the attacker's network segment, and the demonstrated consequence is disclosure of configuration, password, log, or other sensitive files.