diff --git a/http/cves/2024/CVE-2024-41628.yaml b/http/cves/2024/CVE-2024-41628.yaml
index cf43ad419a..4a34334641 100644
--- a/http/cves/2024/CVE-2024-41628.yaml
+++ b/http/cves/2024/CVE-2024-41628.yaml
@@ -24,7 +24,8 @@ info:
     vendor: severalnines
     product: cluster_control
     fofa-query: icon_hash="160707013" || icon_hash="-1815707560"
-  tags: cve,cve2024,severalnines,cluster-control,directory-traversal
+  tags: cve,cve2024,severalnines,cluster-control,lfi
+
 flow: http(1) && http(2)
 
 http:
@@ -50,6 +51,7 @@ http:
     matchers-condition: and
     matchers:
       - type: regex
+        part: body
         regex:
           - 'root:.*:0:0:'