CVE-2024-4841

Katalog CVE

CVSS 3.3 · Low EPSS 0,67%

Kerentanan Path Traversal: '\..\filename' pada lollms-webui. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.

Rincian

Terbit di NVD

23 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-29: Path Traversal: '\..\filename'

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602 exploit · advisory pihak ketiga