CVE-2024-4322

🗓️ 16 May 2024 09:03:45Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

A path traversal vulnerability exists in parisneo/lollms-webui. Manipulating the `category` parameter allows directory traversal, affecting the latest version and potentially leading to information disclosure

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-4322	10 May 202612:00	–	circl
CNNVD	LoLLMs Security Vulnerabilities	16 May 202400:00	–	cnnvd
Cvelist	CVE-2024-4322 Path Traversal in parisneo/lollms-webui	16 May 202409:03	–	cvelist
EUVD	EUVD-2024-43965	3 Oct 202520:07	–	euvd
Nuclei	LoLLMS WebUI < 9.8 - Path Traversal	21 Jul 202603:59	–	nuclei
NVD	CVE-2024-4322	16 May 202409:15	–	nvd
OSV	CVE-2024-4322 Path Traversal in parisneo/lollms-webui	16 May 202409:03	–	osv
Positive Technologies	PT-2024-30383	16 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4322	5 Feb 202500:15	–	redhatcve
Vulnrichment	CVE-2024-4322 Path Traversal in parisneo/lollms-webui	16 May 202409:03	–	vulnrichment

NVD

Node

lollms lollms_web_uiRange<9.8

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209

Parameter	Position	Path	Description	CWE
category	query param	/list_personalities	Path traversal vulnerability in list_personalities via the category parameter allowing listing of arbitrary directories.	CWE-29

17 Jun 2026 08:01Current

6.5Medium risk

Vulners AI Score6.5

CVSS 37.5

EPSS0.30987

SSVC

CWE-29