CVE-2024-26261: Hgiga OAKlouds - Arbitrary File Read And Delete

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-15 · updated 2026-06-17
Weakness: CWE-22

Description

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

Affected products

HGiga Oaklouds-Organization-2.0: before 188 — fixed in 188
HGiga Oaklouds-Organization-3.0: before 188 — fixed in 188
HGiga Oaklouds-Webbase-2.0: before 1051 — fixed in 1051
HGiga Oaklouds-Webbase-3.0: before 1051 — fixed in 1051

How to fix

Upgrade to a fixed version: HGiga Oaklouds-Organization-2.0 188; HGiga Oaklouds-Organization-3.0 188; HGiga Oaklouds-Webbase-2.0 1051; HGiga Oaklouds-Webbase-3.0 1051. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-26261 or the next vulnerability affects your stack