CVE-2024-12866: Youdao Qanything Path Traversal Flaw

CVE-2024-12866 Overview

CVE-2024-12866 is a local file inclusion (LFI) vulnerability in netease-youdao/qanything version 2.0.0. The flaw allows unauthenticated remote attackers to read arbitrary files from the host file system through the application's network-exposed interface. Attackers can retrieve sensitive content including private SSH keys, application source code, and configuration files. Successful exploitation can escalate to remote code execution when recovered credentials or keys enable further access. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated attackers can read arbitrary files on the server, exposing SSH keys and secrets that enable downstream remote code execution.

Affected Products

Youdao QAnything 2.0.0
Deployments using netease-youdao/qanything container or source distribution at version v2.0.0
Self-hosted retrieval-augmented generation (RAG) services built on the affected QAnything release

Discovery Timeline

2025-03-20 - CVE-2024-12866 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12866

Vulnerability Analysis

QAnything is an open-source question-answering system maintained by NetEase Youdao that ingests documents for retrieval-augmented generation. Version 2.0.0 exposes an HTTP endpoint that resolves user-supplied paths without enforcing a safe base directory. An attacker submits a crafted path containing directory traversal sequences such as ../ to escape the intended document root.

The service then opens and returns the contents of the requested file. Because the request requires no authentication and no user interaction, exploitation is trivial over the network. Sensitive targets include /etc/passwd, /root/.ssh/id_rsa, application .env files, and database configuration files.

The EPSS score is 1.39% (68.77th percentile) as of 2026-06-23, reflecting moderate exploitation likelihood.

Root Cause

The root cause is missing input validation and path canonicalization on a file-retrieval parameter. The handler concatenates attacker-controlled input with a base directory and passes the resulting string to a file read operation. No allowlist, canonical-path comparison, or rejection of traversal tokens is applied before the file system call.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues a single HTTP request containing a traversal payload targeting a known sensitive file. The server responds with the raw file contents. Refer to the Huntr Bug Bounty Notice for the disclosure record.

No public proof-of-concept code is referenced in the advisory. The vulnerability mechanism follows the standard LFI pattern: attacker input flows into a file read sink without normalization, allowing reads outside the intended document directory.

Detection Methods for CVE-2024-12866

Indicators of Compromise

HTTP requests to QAnything endpoints containing ../, ..%2f, ..%5c, or URL-encoded traversal sequences in path or query parameters
Access log entries showing responses returning content of system files such as /etc/passwd, /etc/shadow, or id_rsa
Outbound SSH authentication attempts originating from hosts whose private keys reside on the QAnything server
Unexpected reads of application configuration files (.env, config.yaml, application.properties) by the QAnything process

Detection Strategies

Inspect web access logs for path traversal patterns targeting QAnything routes that accept file or document identifiers
Deploy web application firewall rules that decode and normalize request paths before matching traversal signatures
Monitor the QAnything process for open() or read() syscalls against files outside its expected working directory using endpoint telemetry
Correlate file read events with subsequent authentication events to identify credential reuse from exfiltrated keys

Monitoring Recommendations

Enable verbose request logging on the reverse proxy fronting QAnything and forward logs to a central SIEM
Alert on response sizes or content types that indicate sensitive file disclosure from QAnything endpoints
Track outbound network connections from the QAnything host for anomalous SSH or API authentication attempts

How to Mitigate CVE-2024-12866

Immediate Actions Required

Restrict network access to QAnything 2.0.0 instances behind authenticated reverse proxies or VPN until a fixed release is deployed
Rotate all SSH keys, API tokens, and credentials stored on or accessible from affected hosts
Audit access logs for traversal patterns and treat any successful sensitive-file read as a confirmed compromise
Run the QAnything service under a dedicated low-privilege user with no access to host SSH keys or unrelated secrets

Patch Information

No vendor advisory or patched release is listed in the NVD record at the time of publication. Monitor the netease-youdao/qanything project and the Huntr disclosure for an official fix. Upgrade to a version later than 2.0.0 once released by the maintainers.

Workarounds

Place a web application firewall in front of QAnything and block requests containing ../, encoded traversal sequences, or absolute paths
Run QAnything inside a minimal container with read-only mounts that exclude /root, /home, and /etc/ssh
Apply mandatory access controls such as AppArmor or SELinux profiles that restrict the QAnything process to its document directory
Remove sensitive files including SSH private keys and cloud credentials from any host that runs the vulnerable version

bash

# Example AppArmor-style restriction for the QAnything process
/opt/qanything/** r,
/opt/qanything/data/** rw,
deny /root/** rwx,
deny /home/*/.ssh/** rwx,
deny /etc/shadow r,