CVE-2024-13984 is a critical path traversal vulnerability (CWE-73, CWE-22) in QiAnXin TianQing Management Center (up to version 6.7.0.4130). The rptsvr component's /rptsvr/upload endpoint fails to properly sanitize the filename parameter in multipart form-data requests, allowing unauthenticated attackers to upload files to arbitrary locations on the server. This can lead to placing executable files in web-accessible directories, which may result in remote code execution. The vulnerability has a CVSS 4.0 score of 10, indicating maximum severity. Exploitation was first observed by Shadowserver Foundation on 2024-08-23. No patch or official remediation has been disclosed by the vendor. The product is not a cloud service, so remediation depends on vendor or user action.

The vulnerability allows unauthenticated attackers to upload files to arbitrary server paths, including web-accessible directories. This can lead to remote code execution, compromising the affected system's confidentiality, integrity, and availability. Given the CVSS score of 10, the impact is critical. Exploitation evidence exists, increasing the urgency of addressing this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /rptsvr/upload endpoint if possible, monitor for suspicious file uploads, and consider implementing web application firewall rules to detect and block path traversal attempts. Avoid exposing the affected service to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.