CVE-2024-8581: A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The…

PriorityP352critical9.1CVSS 3.0

AVNACLPRNUINSUCNIHAH

EPSS

0.90%

55.1th percentile

A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal error.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms_web_ui	—	—
parisneo	parisneo_lollms-webui	>= unspecified < v14	v14

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.