Vulnerability · Published Jun 12, 2024 · Assigned by @huntr_ai
CVE-2024-4315LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms
Critical 9.1
In plain English
A critical-severity path traversal in parisneo/lollms from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lollms | 9.5.0 | GHSA-vqwr-q6cc-c242 |
| PyPI | lollms | 9.5.0 | PYSEC-2026-403 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms | unspecified – before 9.8 |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H