CVE-2024-3322: Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the 'cybersecurity/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'processfolder' function within 'lollms-webui/zoos/personalitieszoo/cybersecurity/codeguard/scripts/processor.py'. Specifically, the function fails to properly sanitize user-supplied input for the 'codefolderpath', allowing an attacker to specify arbitrary paths using '../' or absolute paths. This flaw leads to arbitrary file read and overwrite capabilities in specified directories without limitations, posing a significant risk of sensitive information disclosure and unauthorized file manipulation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3322?
CVE-2024-3322 has been classified with a moderate severity level due to its potential impact on file security.
How do I fix CVE-2024-3322?
To fix CVE-2024-3322, update to a version of lollms-webui that is above 9.5.
What does CVE-2024-3322 affect?
CVE-2024-3322 affects the 'cyber_security/codeguard' native personality of the lollms-webui software.
What causes CVE-2024-3322?
CVE-2024-3322 is caused by improper limitations on a pathname which allows path traversal.
What versions are affected by CVE-2024-3322?
Versions of lollms-webui up to 9.5 are affected by CVE-2024-3322.