CVE-2024-5125: parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files…

PriorityP430high7.3CVSS 3.1

AVLACLPRNUIRSUCLIHAH

EPSS

0.31%

22.9th percentile

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms-webui	—	—
parisneo	parisneo_lollms-webui	>= unspecified < 9.8	9.8

CVSS provenance

nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

nvdv3.07.3HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.