CVE-2024-10019

A vulnerability in the "startappserver" function of parisneo/lollms-webui V12 Strawberry allows for path traversal and OS command injection. The function does not properly sanitize the "appname" parameter, enabling an attacker to upload a malicious "server.py" file and execute arbitrary code by...

CVE-2024-10019: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the startappserver function of parisneo/lollms-webui V12 Strawberry allows for path traversal and OS command injection. The function does not properly sanitize the appname parameter, enabling an attacker to upload a malicious server.py file and execute arbitrary code by...