CVE-2024-10019: A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function…

PriorityP337medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

EPSS

0.80%

51.9th percentile

A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms_web_ui	—	—
parisneo	parisneo_lollms-webui	unspecified – latest	—

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv3.06.3MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.