A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files on the server, potentially exposing sensitive information such as private SSH keys, configuration files, and source code.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/6df4f990-b632-4791-b3ea-f40c9ea905bf | Exploit Third Party Advisory Issue Tracking |
Configurations
History
09 Jul 2025, 14:18
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:lollms:lollms_web_ui:9.8:*:*:*:*:*:*:* | |
| First Time |
Lollms
Lollms lollms Web Ui |
|
| CWE | ||
| References | () https://huntr.com/bounties/6df4f990-b632-4791-b3ea-f40c9ea905bf - Exploit, Third Party Advisory, Issue Tracking |
30 Sep 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-30 08:15
Updated : 2025-07-09 14:18
NVD link : CVE-2024-6394
Mitre link : CVE-2024-6394
JSON object : View
Products Affected
lollms
- lollms_web_ui
CWE
No CWE.