CVE-2024-5182

Katalog CVE

CVSS 9.1 · Critical EPSS 25,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mudler localai. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.

Rincian

Terbit di NVD

20 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

25,5% peluang dieksploitasi; lebih tinggi dari 97,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e patch
• https://huntr.com/bounties/f7a87f29-c22a-48e8-9fce-b6d5a273e545 exploit · issue tracking · patch