CVE-2024-4498

Katalog CVE

CVSS 7.7 · High EPSS 0,49%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lollms web ui. Skor CVSS 3.0 7.7 (High) menurut huntr.dev.

Deskripsi (NVD)

A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the `/apply_settings` function, allowing an attacker to manipulate the `discussion_db_name` parameter to traverse the file system and include arbitrary files. This issue is compounded by the bypass of input filtering in the `install_binding`, `reinstall_binding`, and `unInstall_binding` endpoints, despite the presence of a `sanitize_path_from_endpoint(data.name)` filter. Successful exploitation enables an attacker to upload and execute malicious code on the victim's system, leading to Remote Code Execution (RCE).

Rincian

Terbit di NVD

25 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.7 (High), sumber huntr.dev
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/9238e88a-a6ca-4915-9b5d-6cdb4148d3f4 exploit · issue tracking · patch · advisory pihak ketiga