CVE-2024-13991 — Huijietong Cloud Video Platform fileDownload Arbitrary File Read
Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPath` parameter of th…
Published: 2025-10-15 · CVSS: 8.7 · CVSS 4.0
Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPath` parameter of the `/fileDownload?action=downloadBackupFile` endpoint and retrieve files from the server filesystem. VulnCheck has observed this vulnerability being exploited in the wild.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7