CVE-2024-58387 Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
Unauthenticated attackers can read arbitrary files via path traversal in the file download endpoint, exposing sensitive system and application data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58387?
CVE-2024-58387 is a high-severity path traversal vulnerability in Inspur Haiyue HCM Cloud, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
Weakness: CWE-22
Which versions are affected by CVE-2024-58387?
How do I fix CVE-2024-58387?
No fix has been published for CVE-2024-58387 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-58387 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58387 exists.
Sources
Also known as GHSA-9frq-682f-p456.