Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint. Attackers can supply unvalidated path parameters 'index' and 'ext' to traverse the filesystem and read arbitrary files without authentication. This allows disclosure of sensitive system and application files. The vulnerability was first observed exploited in the wild by Shadowserver Foundation on 2024-11-04. It has a CVSS 4.0 score of 8.7 (high severity) with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive system files such as /etc/passwd, application database files, and system configuration files. This can lead to information disclosure that may facilitate further attacks or compromise of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint where possible and monitor for suspicious requests targeting the /api/model_report/file/download endpoint with path traversal patterns.