CVE-2024-6250: Absolute Path Traversal in parisneo/lollms-webui

Published Jun 27, 2024

Updated

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.

Affected Software

2 affected components

parisneo lollms-webui

lollms Lollms Web Ui=9.6

Event History

Jun 27, 2024

CVE Published

via MITRE·06:41 PM

Data Sourced

via MITRE·06:41 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-6250?

CVE-2024-6250 has been rated as a high severity vulnerability due to its potential for remote file access.

How do I fix CVE-2024-6250?

To mitigate CVE-2024-6250, update to the latest version of parisneo/lollms-webui where this vulnerability has been patched.

What does CVE-2024-6250 affect?

CVE-2024-6250 affects the `open_file` endpoint in the `lollms_advanced.py` file of parisneo/lollms-webui version 9.6.

What type of vulnerability is CVE-2024-6250?

CVE-2024-6250 is classified as an absolute path traversal vulnerability.

How can attackers exploit CVE-2024-6250?

Attackers can exploit CVE-2024-6250 by leveraging the `sanitize_path` function to access arbitrary files on a Windows system.