CVE-2024-5182
published 2024-06-20CVE-2024-5182: A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process…
PriorityP269critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
25.54%
97.7th percentile
A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | go-skynet_localai | >= 0 < 2.16.0 | 2.16.0 |
| mudler | localai | < 2.16.0 | 2.16.0 |
| mudler | mudler_localai | >= unspecified < 2.16.0 | 2.16.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
osv·2024-06-28
CVE-2024-5182 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/go-skynet/LocalAI before v2.16.0.
GHSA
LocalAI path traversal vulnerability
ghsa·2024-06-20
CVE-2024-5182 [HIGH] CWE-22 LocalAI path traversal vulnerability
LocalAI path traversal vulnerability
A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
OSV
LocalAI path traversal vulnerability
osv·2024-06-20
CVE-2024-5182 [HIGH] LocalAI path traversal vulnerability
LocalAI path traversal vulnerability
A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-20
Published