CVE-2024-9597 — Path Traversal in Lollms

CWE-22 — Path TraversalCWE-416 — Use After Free3 documents3 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 80.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Parisneo Lollms
Timeline
PublishedMar 20

Description

A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the `key` parameter, which is used to construct file paths. An attacker can exploit this by sending a specially crafted HTTP request to delete arbitrary directories.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages1 packages

▶CVEListV5parisneo/parisneo_lollmsunspecified — latest

🔴Vulnerability Details

1
GHSA
GHSA-67hg-xcw3-33fm: A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on↗2025-03-20
▶

📋Vendor Advisories

1
Red Hat
kernel: netfilter: nf_tables: unconditionally flush pending work before notifier↗2024-07-30
▶