CVE-2024-4330
Path Traversal in parisneo/lollms-webui
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal in parisneo/lollms-webui
| Assigner | @huntr_ai |
| Reserved | 2024-04-29 |
| Published | 2024-05-30 |
| Updated | 2024-08-01 |
A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.
| CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
CWE-23 Relative Path Traversal
https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7
