{"id":"CVE-2024-58387","published":"2026-09-30T21:16:52.510","lastModified":"2026-10-01T19:17:15.250","description":"Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://cn-sec.com/archives/3372984.html","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/hcm/hcm-cloud-lfi.yaml","tags":[]},{"url":"https://www.vulncheck.com/advisories/inspur-hcm-cloud-arbitrary-file-read-via-file-download-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/hcm/hcm-cloud-lfi.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"The Inspur Haiyue HCM Cloud system has an arbitrary file read vulnerability in its model report file download endpoint, allowing attackers to read any file on the server's filesystem without authentication. This flaw enables disclosure of sensitive system files, database contents, and configuration data.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to traverse the filesystem using crafted path parameters in the download endpoint.","blast_radius":"If exploited, this vulnerability could lead to widespread exposure of critical system files, database credentials, and application configuration, potentially enabling further attacks on the underlying infrastructure.","remediation":"Immediate remediation requires upgrading to version 2.590 or later, as specified in the vendor advisory for CVE-2024-58387.","detection":"Defenders should monitor for unusual GET requests to /api/model_report/file/download with path traversal parameters in access logs, particularly when index parameter contains ../ sequences or when ext parameter references system files like /etc/passwd.","tags":["file-read","web","unauthenticated","path-traversal"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:08:07.123Z"}}