CVE-2024-10019: Path Traversal and OS Command Injection in parisneo/lollms-webui

Published Mar 20, 2025

Updated

A vulnerability in the startappserver function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the appname parameter, enabling an attacker to upload a malicious server.py file and execute arbitrary code by exploiting the path traversal vulnerability.

Affected Software

2 affected components

parisneo lollms-webui

lollms Lollms Web Ui=12

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-10019?

CVE-2024-10019 is classified as a high severity vulnerability due to its potential for OS command injection and path traversal.

How do I fix CVE-2024-10019?

To fix CVE-2024-10019, ensure proper sanitization of the 'app_name' parameter in the `start_app_server` function.

What systems are affected by CVE-2024-10019?

CVE-2024-10019 affects the parisneo/lollms-webui V12 (Strawberry) application.

What type of attack can exploit CVE-2024-10019?

CVE-2024-10019 can be exploited through path traversal and OS command injection attacks.

Is it possible to execute arbitrary code due to CVE-2024-10019?

Yes, an attacker can exploit CVE-2024-10019 to upload and execute a malicious `server.py` file.