A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Metrics
Affected Vendors & Products
References
History
Fri, 15 Nov 2024 17:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Lollms
Lollms lollms |
|
CPEs | cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:* | |
Vendors & Products |
Lollms
Lollms lollms |
|
Metrics |
cvssV3_1
|
Fri, 11 Oct 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Parisneo
Parisneo lollms |
|
CPEs | cpe:2.3:a:parisneo:lollms:*:*:*:*:*:*:*:* | |
Vendors & Products |
Parisneo
Parisneo lollms |
|
Metrics |
ssvc
|
Fri, 11 Oct 2024 15:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files. | |
Title | Path Traversal in api open_personality_folder in parisneo/lollms-webui | |
Weaknesses | CWE-23 | |
References |
| |
Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2024-10-11T15:38:08.686Z
Updated: 2024-10-11T16:14:37.424Z
Reserved: 2024-07-22T22:03:45.352Z
Link: CVE-2024-6985
Vulnrichment
Updated: 2024-10-11T16:14:32.350Z
NVD
Status : Analyzed
Published: 2024-10-11T16:15:14.657
Modified: 2024-11-15T17:10:59.157
Link: CVE-2024-6985
Redhat
No data.