CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-26261
Critical (9.8) in hgiga. EPSS 0.7% chance of exploitation in the next 30 days.
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hgiga:oaklouds-organization-2.0
- hgiga:oaklouds-organization-3.0
- hgiga:oaklouds-webbase-2.0
- hgiga:oaklouds-webbase-3.0