CVE-2024-6985
published 2024-10-11CVE-2024-6985: A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any…
PriorityP425medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.35%
27.2th percentile
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lollms | lollms | < 5.9.0 | 5.9.0 |
| lollms | lollms | >= 0 < 28ee567a9a120967215ff19b96ab7515ce469620 | 28ee567a9a120967215ff19b96ab7515ce469620 |
| lollms | lollms | >= 0 < 5.9.0 | 5.9.0 |
| lollms | lollms | 0 – 9.5.1 | — |
| parisneo | parisneo_lollms | >= unspecified < 5.9.0 | 5.9.0 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv3.04.4MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-6985: A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui
osv·2024-10-11
CVE-2024-6985 CVE-2024-6985: A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
GHSA
Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
ghsa·2024-10-11
CVE-2024-6985 [MEDIUM] CWE-23 Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
OSV
Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
osv·2024-10-11
CVE-2024-6985 [MEDIUM] Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-11
Published