CVE-2024-1098 is a Medium severity information disclosure, scored 4.3, in Rebuild, a business application platform, in versions up to 3.5.5. The flaw is in QiniuCloud.getStorageFile of /filex/proxy-download. The record names no fixed version, so check the project and limit access to the endpoint.
What's affected
The record lists Rebuild up to and including 3.5.5. The affected function is QiniuCloud.getStorageFile in the file /filex/proxy-download, and manipulation of the url argument leads to information disclosure. The record states the exploit has been disclosed publicly.
The record names no fixed version, and I could not read the VulDB entry or the linked write up. Check the project's releases for anything after 3.5.5 that mentions the proxy download endpoint.
How to check if you're exposed
Find Rebuild deployments and read the version from the admin page or the packaged build. Anything at or below 3.5.5 is in scope.
Search web logs for requests to the proxy-download path, especially with unusual url values. The sources do not give a detection signature, so treat log review as a lead. The free in-browser dependency scan will show whether Rebuild appears in your own dependency manifests.
What to do now
- Inventory Rebuild instances and versions.
- Check the project for a release after 3.5.5 and read its notes.
- Block or restrict the proxy download route at the reverse proxy until you can confirm a fix.
- Review what the application's storage credentials can reach, and use the narrowest scope.
- Record the exposure and re-check when the vendor ships a fix.
Why it matters
The class is exposure of sensitive information, CWE-200. A proxy style download endpoint that takes a URL from the caller can be steered to content the caller should not see. The record does not say what is exposed, so avoid assuming it is trivial.
The score of 4.3 is Medium, which suits a bug with limited confidentiality impact. Even so, an endpoint that fetches on behalf of a user deserves an allow list of destinations. The record's KEV flag is false.
Quick check
Is there a fixed version?
The record names none. It says versions up to 3.5.5 are affected.
How serious is it?
The record scores it 4.3, Medium, with an exploit disclosed publicly according to the record.
Sources
Last reviewed: 19 October 2026.
