CVE-2024-0882 is a medium severity (CVSS 4.3) path traversal in qwdigital LinkWechat 5.1.0, in the universal download interface at /linkwechat-api/common/download/resource. The vendor did not respond, so check upstream for a fixed release and restrict outside access to the endpoint until one is installed.
What's affected
qwdigital LinkWechat 5.1.0. The affected part is the Universal Download Interface at /linkwechat-api/common/download/resource, through the name argument. The record says the attack can be initiated remotely and an exploit has been disclosed.
The record says the vendor did not respond to disclosure, and no fixed version is named.
The record classifies the weakness as CWE-24 (path traversal using ../filedir) and CWE-22 (path traversal). NVD scores it 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
The description calls the issue problematic, while NVD scores it 4.3 (Medium). The record lists CWE-24 and CWE-22.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run LinkWechat anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Find LinkWechat 5.1.0 installs and check upstream for a newer release.
- Block external access to the download endpoint with a gateway rule until it is fixed.
- In code, resolve the requested path and confirm it stays inside the intended directory before opening it.
- Check the server for files that should not be readable by the application account and tighten permissions.
Why it matters
Path traversal (CWE-22 and the related CWE-24) lets a parameter such as a file name walk out of the intended folder using parent directory markers. A download endpoint that trusts the name can then serve any file the process can read, such as configuration files or credentials.
The score is moderate because only read access is described, but secrets exposed this way often lead to bigger incidents.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
What is the right code fix?
Normalise the path, compare it with the allowed base directory, and refuse anything outside. Prefer an ID lookup over user supplied file names.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
