THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4330

Path Traversal in parisneo/lollms-webui

Assigner:@huntr_ai (c09c270a-b464-47c1-9133-acb35b22c19a)
Reserved:2024-04-29
Published:2024-05-30
Updated:2024-06-07

Description

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.



MEDIUM: 4.0CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-23 Relative Path Traversal

Product status

Any version
affected

References

https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7

cve.org CVE-2024-4330

nvd.nist.gov CVE-2024-4330

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4330