CVE-2024-6971

CVE-2024-6971 describes a path traversal in the ParisNeo/lollms-webui project where functions in lollms_file_system.py (add_rag_database, toggle_mount_rag_database, vectorize_folder) do not sanitize paths, allowing an attacker to vectorize arbitrary .sqlite files on a victim’s machine. This can e...

LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from improper parameter cleanup, resulting in a path traversal vulnerability that allows an attacker to read any file on the victim's comput...

PT-2024-38010

Name of the Vulnerable Software and Affected Versions lollms-webui affected versions not specified lollms affected versions not specified Description A path traversal issue exists in the lollms file system.py file, specifically affecting the functions add rag database, toggle mount rag database,...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a path traversal vulnerability that originates from allowing an attacker to perform vectorization operations on .sqlite files in any directory on the victim's computer, whic...

CVE-2024-6394 Local File Inclusion in parisneo/lollms-webui

A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the servejs function in app.py, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files ...

CVE-2024-6394 Local File Inclusion in parisneo/lollms-webui

A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the servejs function in app.py, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files ...

LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to v9.8, which stems from an unverified path connection in the servejs function in app.py. An attacker exploiting this vulnerability can...

CVE-2024-6040

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

CVE-2024-6040

CVE-2024-6040 affects parisneo/lollms-webui v9.8 where lollms_binding_infos lacks the client_id parameter. The endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are vulnerable to CSRF and local attacks, ...

CVE-2024-6040 Missing client_id in parisneo/lollms-webui

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

CVE-2024-6040 Missing client_id in parisneo/lollms-webui

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

CVE-2024-6040 Missing client_id in parisneo/lollms-webui

In parisneo/lollms-webui version v9.8, the lollmsbindinginfos is missing the clientid parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reloadbinding, /installbinding, /reinstallbinding, /unInstallbinding, /setactivebindingsettings, and /updatebindingsettin...

LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version v9.8 that stems from vulnerability to CSRF attacks and local attacks, which can be exploited by an attacker to perform unauthorized actions on...

Path Traversal

parisneo/lollms is vulnerable to Path Traversal. The vulnerability is due to the sanitizepath function within the file lollmsconfigurationinfos.py, which allows attackers to manipulate the discussiondbname parameter and potentially write to important system directories...

LoLLMS vulnerable to Expected Behavior Violation

A path traversal vulnerability exists in the applysettings function of parisneo/lollms versions prior to 9.5.1. The sanitizepath function does not adequately secure the discussiondbname parameter, allowing attackers to manipulate the path and potentially write to important system folders...

GHSA-8MRM-R7H3-C3HJ LoLLMS vulnerable to Expected Behavior Violation

A path traversal vulnerability exists in the applysettings function of parisneo/lollms versions prior to 9.5.1. The sanitizepath function does not adequately secure the discussiondbname parameter, allowing attackers to manipulate the path and potentially write to important system folders...

CVE-2024-6281

A path traversal vulnerability exists in the applysettings function of parisneo/lollms versions prior to 9.5.1. The sanitizepath function does not adequately secure the discussiondbname parameter, allowing attackers to manipulate the path and potentially write to important system folders...

CVE-2024-6281

A path traversal vulnerability exists in the applysettings function of parisneo/lollms versions prior to 9.5.1. The sanitizepath function does not adequately secure the discussiondbname parameter, allowing attackers to manipulate the path and potentially write to important system folders...

CVE-2024-6281 Path Traversal in parisneo/lollms

A path traversal vulnerability exists in the applysettings function of parisneo/lollms versions prior to 9.5.1. The sanitizepath function does not adequately secure the discussiondbname parameter, allowing attackers to manipulate the path and potentially write to important system folders...

CVE-2024-6281

CVE-2024-6281 describes a path traversal vulnerability in the Parisneo/LoLLMS project where the sanitize_path logic in the apply_settings flow fails to properly constrain the discussion_db_name parameter. Affected versions are prior to 9.5.1. Existence of this flaw allows path manipulation and po...