CVE-2024-58396 YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2024-58396?
CVE-2024-58396 is a high-severity vulnerability in YouDataSum CPAS Audit Management System, published on 22 Oct 2026.
Official description
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
Weakness: CWE-22
Which versions are affected by CVE-2024-58396?
How do I fix CVE-2024-58396?
No fix has been published for CVE-2024-58396 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58396 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58396 exists.
Sources
Also known as GHSA-h4xq-5878-6xvr.