Arbitrary file read via encrypted path traversal

Path traversal in OfficeWeb365 7.18.23.0 and 8.6.1.0 allows remote attackers to read arbitrary server files through Pic/Indexs. The Pic/Indexs handler decrypts the attacker-controlled imgs value with a fixed DES key and initialization vector, then accepts the resulting traversal path without confining file access to an intended directory. No authentication or user interaction is required, and the demonstrated consequence is disclosure of readable host files rather than modification or service interruption.