CVE-2024-8898

🗓️ 20 Mar 2025 10:10:58Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 115 Views🌐 WEB

Path traversal vulnerability in install/uninstall API of parisneo/lollms-webui allows arbitrary directory access.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-8898	20 Mar 202517:18	–	circl
CNNVD	LoLLMs Web UI security vulnerabilities	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-8898 Path Traversal in parisneo/lollms-webui	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-6880	3 Oct 202520:07	–	euvd
Mend	CVE-2024-8898	20 Mar 202510:10	–	mend
NVD	CVE-2024-8898	20 Mar 202510:15	–	nvd
osv_cve	CVE-2024-8898 Path Traversal in parisneo/lollms-webui	20 Mar 202510:10	–	osv_cve
Positive Technologies	PT-2025-12248	20 Mar 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-8898: Improper Limitation of a Pathname to a Restricted Directory	20 Mar 202500:00	–	rapid7
RedhatCVE	CVE-2024-8898	22 Mar 202512:46	–	redhatcve

NVD

Node

lollms lollms_web_uiMatch12

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "V12",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/6072371f-0ddc-42e3-9207-1c6d6b18d32f
github	www.github.com/parisneo/lollms-webui/commit/6d07c8a0dd0a15cc060becc73fda9fe8e788eb23

Parameter	Position	Path	Description	CWE
path	path	/install	Path traversal in the install API endpoint allowing arbitrary directory creation.	CWE-22
path	path	/uninstall	Path traversal in the uninstall API endpoint allowing arbitrary directory deletion.	CWE-22

17 Jun 2026 08:23Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

CVSS 36.7

EPSS0.00812

SSVC

CWE-22