HUATIAN DYNAMIC OA8000 · CVE-2024-58406 · Other
NO FIX YET
The Huatian Dynamic OA8000 collaborative office system has a path traversal flaw in its ntkodownload.jsp page, where the filename parameter accepts ../ sequences. An unauthenticated attacker can read arbitrary files from the server, including Tomcat configuration files that may hold credentials.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running a self-hosted Huatian Dynamic OA8000 collaborative office system, especially with the web interface reachable from the internet. The flaw needs no login and exposes server files such as Tomcat web.xml, which can hold credentials. Teams that do not run OA8000 can skip it.
Not affected if not-oa8000
Who cares huatian, java, oa8000, path-traversal, self-hosted, tomcat, unauthenticated
No fix yet, per the sources.
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.