CVE-2024-58387

Inspur Haiyue HCM Cloud is vulnerable to an arbitrary file read vulnerability within the /api/model_report/file/download endpoint. The root cause is the application's failure to validate the index and ext path parameters. This allows unauthenticated remote attackers to perform filesystem traversa...