YouDataSum CPAS Audit Management System: Path traversal in downPlugs fileId
Summary
The CPAS Audit Management System V4 from YouDataSum contains a path traversal flaw in the fileId parameter of the downPlugs endpoint. An unauthenticated remote attacker can send crafted GET requests with ../ sequences to read arbitrary files on the server, such as /etc/passwd. Exploitation requires no login or user interaction, and internet-exposed instances are at highest risk. A public proof of concept exists.
Affected
- YouDataSum CPAS Audit Management System V4
- Exact affected build range: Unknown.
Fixed in
Unknown. No vendor fix or advisory was found.
Workaround
- No vendor workaround confirmed.
- Restrict access to the CPAS web interface to internal networks or VPN and remove direct internet exposure.
- As a stopgap, place an authenticating reverse proxy or WAF in front of the application and block requests to the downPlugs path.
- Run the application under a least-privilege account with limited filesystem read access.
Exploitation
- Public proof of concept and a Nuclei template are available.
- CISA SSVC lists exploitation as poc and automatable: yes.
- A Shadowserver observation dated 2025-01-13 is claimed but unverified.
- Conflicting reports: one aggregator lists a VulnCheck KEV entry that could not be verified; CISA KEV does not list the CVE.
- Assume exploitation is feasible.
Our recommendation
- Check whether any CPAS V4 instance is reachable from the internet and treat exposed instances as high priority.
- Remove direct internet exposure or restrict access to VPN or internal networks.
- Apply the stopgap controls above until YouDataSum confirms a fix; ask the vendor for the affected build range and a patch.
- Review web server logs for requests to downPlugs with unusual fileId values and treat any hit as a possible compromise, including credential exposure.
- Monitor the NVD record and vendor site for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Proof of concept (GitHub, eeeeeeeeee-code) github.com
- Vulnerability reproduction write-up (GitHub, gelusus) github.com
- Nuclei template (ProjectDiscovery) github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 425275 vuldb.com
- HOL Guard CVE entry hol.org
- Strix CVE entry www.strix.ai
- YouDataSum website www.youdatasum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:47.
Original description (NVD)
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
NVD references (5)
- https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E5%8C%97%E4%BA%AC%E5%8F%8B%E6%95%B0%E8%81%9A%E7%A7%91%…
- https://github.com/gelusus/wxvl/blob/main/doc/2024-12/%E3%80%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E3%80%8D%…
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/cpas-managment-lfi.…
- https://www.vulncheck.com/advisories/youdatasum-cpas-audit-management-system-v4-path-traversal-via-downplugs-…
- https://www.youdatasum.com/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.