CVE-2024-6250

published 2024-06-27

CVE-2024-6250: An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The…

Priority P1 79 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

ITW EXPLOIT VulnCheck KEV

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms_web_ui	—	—
parisneo	parisneo_lollms-webui	unspecified – latest	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /open_file HTTP/1.1↗

url POST /api/open_file HTTP/1.1↗

path C:/Windows/win.ini↗

path lollms_advanced.py↗

sigma↗

detection: keywords: - 'bit app support' AND '[fonts]' AND '[extensions]' in HTTP response body with status 200 and content-type text/plain to /open_file or /api/open_file

• → Monitor for POST requests to /open_file or /api/open_file endpoints containing absolute Windows paths (e.g., C:/) in the JSON body parameter 'path'. ↗
• → Successful exploitation returns HTTP 200 with content-type text/plain and a response body containing 'bit app support', '[fonts]', and '[extensions]' — characteristic strings from Windows win.ini. ↗
• → The vulnerability is triggered when the sanitize_path function is called with allow_absolute_path=True in lollms_advanced.py, permitting arbitrary absolute path access on Windows. ↗

• · The vulnerability is Windows-specific; the absolute path traversal using drive-letter paths (e.g., C:/) only applies to Windows deployments of lollms-webui. ↗
• · The Nuclei template uses stop-at-first-match across two endpoints (/open_file and /api/open_file), meaning only one request may be sent per scan; ensure both endpoints are tested independently in custom detection pipelines. ↗
• · The Nuclei template is marked as unverified (verified: false), so false positive/negative rates are unknown. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-36