What is CVE-2024-12866?

CVE-2024-12866 is a high-severity vulnerability in Netease-Youdao Netease-Youdao/qanything, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2024-12866?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Netease-Youdao Netease-Youdao/qanything

CVE-2024-12866

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.014 (69.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Netease-youdao Netease-youdao/qanything — versions unspecified
Youdao Qanything — versions 2.0.0

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-12866?: CVE-2024-12866 is a high-severity vulnerability in Netease-Youdao Netease-Youdao/qanything, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2024-12866?: High severity. CVSS v3 base score is 7.5 out of 10.