CVE-2024-4841: medium-severity vulnerability in parisneo/lollms-webui
Path Traversal in parisneo/lollms-webui
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 4epss 0.7%
from disclosure to weapon
Published on NVDJun 23
VulnCheck+626d
A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
parisneo · parisneo/lollms-webuiRelated CVEs — parisneo/lollms-webui
In the same product, most dangerous first.
CVE-2024-1520CRITICALOS Command Injection in parisneo/lollms-webuiEPSS 48.2%CVE-2024-1601HIGHSQL Injection in parisneo/lollms-webuiEPSS 40.4%CVE-2024-4320CRITICALRemote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webuiEPSS 34.4%CVE-2024-1600CRITICALLocal File Inclusion in parisneo/lollms-webuiEPSS 32.5%CVE-2024-4322HIGHPath Traversal in parisneo/lollms-webuiEPSS 30.8%CVE-2024-1873HIGHPath Traversal and Denial of Service in parisneo/lollms-webuiEPSS 13.4%