CVE-2024-9597: Path Traversal in parisneo/lollms
A Path Traversal vulnerability exists in the /wipedatabase endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the key parameter, which is used to construct file paths. An attacker can exploit this by sending a specially crafted HTTP request to delete arbitrary directories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9597?
CVE-2024-9597 is a high-severity vulnerability due to its potential for an attacker to delete any directory on the system.
How do I fix CVE-2024-9597?
To mitigate CVE-2024-9597, ensure proper validation and sanitization of the 'key' parameter in the '/wipe_database' endpoint.
What systems are affected by CVE-2024-9597?
CVE-2024-9597 affects the parisneo/lollms application version v12.
What type of vulnerability is CVE-2024-9597?
CVE-2024-9597 is a Path Traversal vulnerability that allows unauthorized file system access.
Could CVE-2024-9597 lead to data loss?
Yes, exploitation of CVE-2024-9597 can lead to significant data loss by allowing an attacker to delete directories.