CVE-2024-2178: Path Traversal Vulnerability in parisneo/lollms-webui
A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy to custom personas folder for editing' process. By inserting '../' sequences in these parameters, attackers can traverse the directory structure and access files outside of the intended directory. Successful exploitation results in unauthorized access to sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2178?
CVE-2024-2178 is classified with a moderate severity level due to its potential to allow unauthorized file access.
How do I fix CVE-2024-2178?
To fix CVE-2024-2178, validate and sanitize the 'category' and 'name' parameters in the 'copy_to_custom_personas' endpoint.
What type of vulnerability is CVE-2024-2178?
CVE-2024-2178 is a path traversal vulnerability that permits attackers to read arbitrary files.
Which software is affected by CVE-2024-2178?
CVE-2024-2178 affects the parisneo/lollms-webui software.
Can CVE-2024-2178 lead to sensitive information disclosure?
Yes, CVE-2024-2178 can lead to sensitive information disclosure if exploited successfully.