CVE-2024-12866

PoC —

CVSS 3.1

7.5 high

EPSS

1%p73

Published

Mar 20, 2025 (Mar 20, 2025)

Modified

Jun 17, 2026

Description

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

Vendors: youdao
Products: qanything
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.