CVE-2024-2362: Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'delpreset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'delpreset' endpoint to delete files outside of the intended directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2362?
CVE-2024-2362 has a high severity rating due to its potential to allow an attacker to delete arbitrary files from the system.
How do I fix CVE-2024-2362?
To fix CVE-2024-2362, upgrade Lollms Web UI to version 9.4 or later where the path traversal vulnerability is addressed.
Which platforms are affected by CVE-2024-2362?
CVE-2024-2362 affects Lollms Web UI version 9.3 on both Windows and Linux platforms.
What type of vulnerability is CVE-2024-2362?
CVE-2024-2362 is a path traversal vulnerability that allows unauthorized file deletions.
Can CVE-2024-2362 be exploited by remote attackers?
Yes, CVE-2024-2362 can be exploited by remote attackers if they can interact with the affected application.