CVE-2024-3429: Path Traversal in parisneo/lollms
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.5.0.
Other sources
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3429?
CVE-2024-3429 is classified as a high-severity vulnerability due to its potential for arbitrary file reading.
How do I fix CVE-2024-3429?
To fix CVE-2024-3429, update the lollms package to version 9.6 or later.
Which versions of lollms are affected by CVE-2024-3429?
CVE-2024-3429 affects all versions of the lollms package prior to 9.6.
What type of vulnerability is CVE-2024-3429?
CVE-2024-3429 is a path traversal vulnerability that allows unauthorized file access.
Where can I find more information about CVE-2024-3429?
Additional information about CVE-2024-3429 can be found in the official lollms repository and security advisories.