CVE-2024-8898

Katalog CVE

CVSS 9.8 · Critical EPSS 0,81%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada lollms web ui. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of user-supplied input, which can be exploited to traverse directories outside the intended path.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parisneo/lollms-webui/commit/6d07c8a0dd0a15cc060becc73fda9fe8e788eb23 patch
• https://huntr.com/bounties/6072371f-0ddc-42e3-9207-1c6d6b18d32f exploit