Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0055 44.3 —
AFFECTED Product Versions Fixed Haiyue HCM Cloud unspecified —
TIMELINE Sep 30 Reserved by VulnCheck Sep 30 Published (CNA: VulnCheck) Oct 1 EXPLOIT PUBLISHED — CVE-2024-58387 (Inspur Haiyue HCM Cloud). Public exploit reference added.
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .
| Date | Event | Detail |
|---|---|---|
| September 30, 2026 | Reserved | Reserved by VulnCheck |
| September 30, 2026 | Published | Published (CNA: VulnCheck) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2024-58387 (Inspur Haiyue HCM Cloud). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Inspur | Haiyue HCM Cloud | — | — | — |
Authoritative record: CVE-2024-58387 at cve.org
Vendors: inspur
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-58387 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
