CVE-2024-6139: falha de alta gravidade em parisneo/lollms
Path Traversal in parisneo/lollms
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.5%
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
parisneo · parisneo/lollmsCVEs relacionadas — parisneo/lollms
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0558HIGHUnauthenticated File Upload in parisneo/lollmsEPSS 2.0%CVE-2026-0560HIGHServer-Side Request Forgery (SSRF) in parisneo/lollmsEPSS 1.8%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.3%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%