CVE-2024-12866

HIGH

7.5

Description

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/20/2025

Last Modified8/1/2025

Sourcenvd

Honeypot Sightings0

Affected Products

youdao:qanything

Weaknesses (CWE)

CWE-22

References

https://huntr.com/bounties/c23da7c7-a226-40a2-83db-6a8ab1b2ef64(security@huntr.dev)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.