CVE-2024-1511

Published: Apr 10, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@huntr.dev (Secondary)

Description

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.

Affected (1)

Products: Lollms: Lollms Web Ui

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lollms Lollms Web Ui	Version 9.0

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b

Source: security@huntr.dev

ExploitThird Party Advisory

https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.