PYSEC-2026-1592 lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...

PT-2024-37186

Name of the Vulnerable Software and Affected Versions: parisneo/lollms version 9.4.0 Description: A path traversal issue in the "/set personality config" endpoint allows an attacker to overwrite the configs/config.yaml file, potentially leading to remote code execution by modifying server...