Description
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Published: 2024-10-11
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-0097 A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Github GHSA Github GHSA GHSA-6h64-g7cj-hj56 Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
History

Fri, 15 Nov 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Lollms
Lollms lollms
CPEs cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*
Vendors & Products Lollms
Lollms lollms
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Fri, 11 Oct 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Parisneo
Parisneo lollms
CPEs cpe:2.3:a:parisneo:lollms:*:*:*:*:*:*:*:*
Vendors & Products Parisneo
Parisneo lollms
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Oct 2024 15:45:00 +0000

Type Values Removed Values Added
Description A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Title Path Traversal in api open_personality_folder in parisneo/lollms-webui
Weaknesses CWE-23
References
Metrics cvssV3_0

{'score': 4.4, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Lollms Lollms
Parisneo Lollms
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2024-10-11T16:14:37.424Z

Reserved: 2024-07-22T22:03:45.352Z

Link: CVE-2024-6985

cve-icon Vulnrichment

Updated: 2024-10-11T16:14:32.350Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-11T16:15:14.657

Modified: 2024-11-15T17:10:59.157

Link: CVE-2024-6985

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses