CVE-2024-4322

Katalog CVE

CVSS 7.5 · High EPSS 31,0%

Kerentanan Path Traversal: '\..\filename' pada lollms web ui. Skor CVSS 3.0 7.5 (High) menurut huntr.dev.

Deskripsi (NVD)

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.

Rincian

Terbit di NVD

16 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.5 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-29: Path Traversal: '\..\filename'

EPSS (30 hari)

31,0% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209 exploit · issue tracking · patch · advisory pihak ketiga