VulnerabilityAnalyzed
CVE-2024-12866
A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0.
HIGH 7.5EPSS 1.49%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.49% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- youdao/qanything
- Source
- security@huntr.dev
References
- https://huntr.com/bounties/c23da7c7-a226-40a2-83db-6a8ab1b2ef64Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.