CVE-2024-2178

🗓️ 02 Jun 2024 10:52:32Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 36 Views🌐 WEB

Security vulnerability CVE-2024-2178 in NVD

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui	2 Jun 202410:52	–	cvelist
EUVD	EUVD-2024-27141	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2178	2 Jun 202411:15	–	nvd
RedhatCVE	CVE-2024-2178	7 Jan 202609:08	–	redhatcve
Vulnrichment	CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui	2 Jun 202410:52	–	vulnrichment

NVD

Node

lollms lollms_web_uiRange<9.4

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/e585f1dd-a026-4419-8f42-5835e85fad9e

Parameter	Position	Path	Description	CWE
category	request body	copy_to_custom_personas	Path traversal via ../ in category and name parameters in the Copy to custom personas endpoint, enabling reading arbitrary files outside the intended directory.	CWE-29
name	request body	copy_to_custom_personas	Path traversal via ../ in category and name parameters in the Copy to custom personas endpoint, enabling reading arbitrary files outside the intended directory.	CWE-29

17 Jun 2026 07:23Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

EPSS0.00599

SSVC

CWE-29