CVE-2024-4841: Path Traversal in parisneo/lollms-webui
First published: Sun Jun 23 2024(Updated: )
A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms | >=9.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-4841?
CVE-2024-4841 is considered a high severity vulnerability due to the potential for unauthorized access to sensitive files.
How do I fix CVE-2024-4841?
To fix CVE-2024-4841, ensure that you update the parisneo/lollms-webui to a version that includes input sanitization for the 'add_reference_to_local_mode' function.
Which versions are affected by CVE-2024-4841?
CVE-2024-4841 affects all versions from v9.6 up to the latest version of parisneo/lollms-webui.
What is a Path Traversal vulnerability like CVE-2024-4841?
A Path Traversal vulnerability such as CVE-2024-4841 allows an attacker to access files and directories outside the intended directory structure.
How can attackers exploit CVE-2024-4841?
Attackers can exploit CVE-2024-4841 by manipulating input to access restricted files through the vulnerable 'add_reference_to_local_mode' function.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/references
- agent/author
- agent/event
- agent/severity
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/parisneo
- canonical/parisneo lollms