CVE-2024-10047: parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows…

PriorityP431medium5.3CVSS 3.0

AVNACLPRNUINSUCLINAN

EPSS

0.95%

56.9th percentile

parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms_web_ui	—	—
parisneo	parisneo_lollms-webui	unspecified – latest	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.