CVE-2024-12866

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-12866

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12866.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-12866

Published

2025-03-20T10:11:31.785Z

Modified

2026-07-15T01:49:12.606388797Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Local File Inclusion in netease-youdao/qanything

Details

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12866.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/netease-youdao/qanything

Affected ranges

Type

GIT

Repo

https://github.com/netease-youdao/qanything

Events

Introduced

f3e96fa41325ea978de6bb3eabbd8d0742f33d0c

Last affected

f3e96fa41325ea978de6bb3eabbd8d0742f33d0c

Database specific

{
    "cpe": "cpe:2.3:a:youdao:qanything:2.0.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ]
}

Affected versions

2.*

2.0.0

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12866.json"