Unauthenticated file disclosure via array-valued identifier

Path traversal in Omnispace Agora Project before 25.10 allows remote attackers to read server files through an unauthenticated request. The misc controller's ExternalGetFile action accepts the _id GET parameter as an array, then uses attacker-controlled _id and name values to build the download path and satisfy its MD5 check. No account or user interaction is required; an appended dot limits disclosure to files with an extension, including configuration and exported data.