CVE-2024-1873

🗓️ 06 Jun 2024 18:40:04Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 38 Views🌐 WEB

parisneo/lollms-webui path traversal and denial of service vulnerability in a9d16b

Reporter	Title	Published	Views	Family All 7
CNNVD	LoLLMs Security Vulnerabilities	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-1873 Path Traversal and Denial of Service in parisneo/lollms-webui	6 Jun 202418:40	–	cvelist
EUVD	EUVD-2024-17598	3 Oct 202520:07	–	euvd
NVD	CVE-2024-1873	6 Jun 202419:15	–	nvd
Positive Technologies	PT-2024-18381 · Parisneo · Lollms-Webui	6 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-1873	5 Feb 202505:35	–	redhatcve
Vulnrichment	CVE-2024-1873 Path Traversal and Denial of Service in parisneo/lollms-webui	6 Jun 202418:40	–	vulnrichment

NVD

Vulners

Node

lollms lollms_web_uiMatch-

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "v9.3",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
huntr	www.huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d

Parameter	Position	Path	Description	CWE
path	path	/select_database	Path traversal via exposed /select_database endpoint allowing absolute paths to be used with DiscussionsDB, enabling directory creation and potential DoS/data loss.	CWE-22, CWE-749

15 Oct 2025 13:15Current

8High risk

Vulners AI Score8

CVSS 3.19.1

CVSS 38.2

EPSS0.02419

SSVC