CVE-2024-6281 Path Traversal in parisneo/lollms

2024-07-2003:19:25

CWE-440

@huntr_ai

www.cve.org

cve-2024-6281

path traversal

parisneo/lollms

apply settings

discussion db name

security vulnerability

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS

Percentile

9.3%

JSON

A path traversal vulnerability exists in the apply_settings function of parisneo/lollms versions prior to 9.5.1. The sanitize_path function does not adequately secure the discussion_db_name parameter, allowing attackers to manipulate the path and potentially write to important system folders.

CNA Affected

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "9.5.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]