CVE-2024-1600: Local File Inclusion in parisneo/lollms-webui
A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (../../) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1600?
The severity of CVE-2024-1600 is considered high due to its potential for local file inclusion, allowing attackers to gain unauthorized access to sensitive files.
How do I fix CVE-2024-1600?
To fix CVE-2024-1600, it is recommended to update the parisneo/lollms-webui application to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2024-1600?
CVE-2024-1600 is classified as a Local File Inclusion (LFI) vulnerability, which allows an attacker to include files on a server through crafted URLs.
Which application is affected by CVE-2024-1600?
CVE-2024-1600 affects the parisneo/lollms-webui application specifically within the /personalities route.
Can CVE-2024-1600 be exploited remotely?
Yes, CVE-2024-1600 can be remotely exploited by an attacker through the use of specially crafted URLs that include directory traversal sequences.