Inspur Haiyue HCM Cloud: Arbitrary file read in download endpoint
Summary
Inspur Haiyue HCM Cloud, a cloud-based human capital management platform, contains a path traversal vulnerability (CWE-22) in the /api/model_report/file/download endpoint. The index and ext parameters are not validated, so an unauthenticated remote attacker can read arbitrary files, such as /etc/passwd, application database files and system configuration files. No authentication or user interaction is required.
Affected
- Inspur Haiyue HCM Cloud, all versions (the CVE record lists the version range as "*"; the vendor has not published a version list)
Fixed in
Unknown. No vendor advisory or fixed version was found. Ask Inspur for the fixed build for your release.
Workaround
- Restrict access to /api/model_report/file/download at the reverse proxy or WAF.
- Block requests containing path traversal patterns in the index and ext parameters.
- No vendor-issued workaround was found.
Exploitation
- Public proof of concept: a Nuclei template and a blog post with a request example are publicly available.
- CISA SSVC assessment: exploitation status 'poc', automatable: yes.
- Shadowserver first observation: the CVE description gives 2024-11-04, which conflicts with the 2026 publication date. Confirm with Shadowserver.
- KEV status is conflicting; not confirmed in the CISA KEV catalogue.
Our recommendation
- Check whether Inspur HCM Cloud is in use, including hosted or SaaS instances, and confirm the affected status with the vendor.
- If exposed, restrict the endpoint immediately and apply the vendor fix once available.
- Review web and proxy logs for traversal-style requests to the file download route.
- If exploitation is suspected, assume readable files were disclosed and rotate credentials and secrets stored on the host.
- Monitor the vendor and NVD for an advisory and a fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CN-SEC: Inspur HCM Cloud download arbitrary file read PoC cn-sec.com
- Nuclei template: hcm-cloud-lfi github.com
- VulnCheck advisory: Inspur HCM Cloud arbitrary file read www.vulncheck.com
- OpenCVE: CVE-2024-58387 app.opencve.io
- Vulners VulnCheck enrichment: CVE-2024-58387 vulners.com
- VulDB: CVE-2024-58387 vuldb.com
- Red Packet Security: CVE-2024-58387 alert www.redpacketsecurity.com
- Inspur: HCM Cloud product page en.inspur.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:31.
Original description (NVD)
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.