Vulnerability · Published May 30, 2024 · Assigned by @huntr_ai
CVE-2024-4330Path Traversal in parisneo/lollms-webui
Medium 4.0
In plain English
A medium-severity security flaw in parisneo/lollms-webui from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lollms | no fix listed | GHSA-9p73-x86v-jw57 |
| PyPI | lollms | no fix listed | PYSEC-2026-1589 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms-webui | unspecified – through latest |
Weakness: CWE-23 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N