CVE-2024-4498: Path Traversal and RFI Vulnerability in parisneo/lollms-webui
A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the /applysettings function, allowing an attacker to manipulate the discussiondbname parameter to traverse the file system and include arbitrary files. This issue is compounded by the bypass of input filtering in the installbinding, reinstallbinding, and unInstallbinding endpoints, despite the presence of a sanitizepathfromendpoint(data.name) filter. Successful exploitation enables an attacker to upload and execute malicious code on the victim's system, leading to Remote Code Execution (RCE).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4498?
CVE-2024-4498 is classified as a high severity vulnerability due to the potential for path traversal and remote file inclusion.
How do I fix CVE-2024-4498?
To fix CVE-2024-4498, ensure that your version of the parisneo/lollms-webui application is updated to the latest version beyond v9.7.
What are the impacts of CVE-2024-4498?
CVE-2024-4498 may allow an attacker to gain unauthorized access to files on the server, which could lead to data leakage or remote code execution.
Which versions of parisneo/lollms-webui are affected by CVE-2024-4498?
CVE-2024-4498 affects all versions of the parisneo/lollms-webui application from v9.7 to the latest.
What type of vulnerability is CVE-2024-4498?
CVE-2024-4498 is a Path Traversal and Remote File Inclusion (RFI) vulnerability caused by insufficient input validation.