A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_files_server.py` and `lollms_core/lollms/security.py` files. Due to inadequate validation of file paths between Windows and Linux environments using `Path(path).is_absolute()`, attackers can exploit this flaw to read any file on the system. This issue affects the latest version of LoLLMs running on the Windows platform. The vulnerability is triggered when an attacker sends a specially crafted request to the `/user_infos/{path:path}` endpoint, allowing the reading of arbitrary files, as demonstrated with the `win.ini` file. The issue has been addressed in version 9.5 of the software.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/65979513-db0d-46fd-9977-fcd73bcd8a41 | Exploit Third Party Advisory |
| https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265 | Patch |
Configurations
History
17 Oct 2024, 15:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Lollms
Lollms lollms Web Ui |
|
| CWE | CWE-22 | |
| References | () https://huntr.com/bounties/65979513-db0d-46fd-9977-fcd73bcd8a41 - Exploit, Third Party Advisory | |
| References | () https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265 - Patch |
06 Jun 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:15
Updated : 2024-10-17 15:52
NVD link : CVE-2024-2548
Mitre link : CVE-2024-2548
JSON object : View
Products Affected
lollms
- lollms_web_ui
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')