CVE-2024-1511: lollms web ui

csirt@kutim:~/threat-intel/cve/CVE-2024-1511

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lollms web ui. Skor CVSS 3.0 9.8 (Critical) menurut huntr.dev.

Deskripsi (NVD)

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.

Rincian

Terbit di NVD: 10 April 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.0: 9.8 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lollms	lollms web ui	Versi 9.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.