---
id: "CVE-2024-58396"
kind: "vulnerability"
aliases: ["CVE-2024-58396"]
title: "YouDataSum CPAS audit system lets anyone read server files"
severity: "high"
cvss: 8.7
epss: 0.00389
exploited: true
status: "open"
category: "other"
products: [{"name": "CPAS Audit Management System", "fixed": [], "affected": "V4 (no finer range published)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cpas-audit-management-system", "other", "self-hosted", "windows"]
not_affected_if: ["not-deployed", "not-internet-exposed", "patched-version"]
published_at: "2026-10-22T11:17:06+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58396", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:42:57+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-58396", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# YouDataSum CPAS audit system lets anyone read server files

The CPAS Audit Management System V4 has a path traversal flaw in its plugin download endpoint, where the fileId parameter accepts ../ sequences. An unauthenticated attacker can send a GET request to /cpasm4/plugInManController/downPlugs and read arbitrary system files such as /etc/passwd.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CPAS Audit Management System affected V4 (no finer range published) fixed ?

## How to check

Check whether a CPAS Audit Management System V4 instance is deployed, then request /cpasm4/plugInManController/downPlugs with fileId set to ../../../../etc/passwd and look for passwd contents in the response.

## Fix

No vendor patch known. Do not expose /cpasm4/ to the internet; block /cpasm4/plugInManController/downPlugs at a WAF or reverse proxy; restrict access by VPN or IP allowlist; check logs for ../ in fileId; assume server files (configs, credentials) were readable and rotate secrets if exposed.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-58396
- 2026-10-23T23:42:57+00:00 analyst — VulnCheck advisory (CNA) says Shadowserver observed exploitation from 2025-01-13; PoCs and a Nuclei template are referenced on that page (links not extractable). No vendor advisory or fixed version found; affected is just 'V4'. No X/social search done.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2024-58396

## Documents

- [advisory] VulnCheck: CPAS Audit Management System V4 Path Traversal via downPlugs fileId https://www.vulncheck.com/advisories/youdatasum-cpas-audit-management-system-v4-path-traversal-via-downplugs-fileid

## From the sources

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_