konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.
