The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lollms |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17259 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lollms
Lollms lollms Web Ui |
|
| CPEs | cpe:2.3:a:lollms:lollms_web_ui:9.0:*:*:*:*:*:*:* | |
| Vendors & Products |
Lollms
Lollms lollms Web Ui |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:40:21.305Z
Reserved: 2024-02-14T20:51:16.717Z
Link: CVE-2024-1511
Vulnrichment
Updated: 2024-08-01T18:40:21.305Z
NVD
Status : Analyzed
Published: 2024-04-10T17:15:51.670
Modified: 2025-07-09T14:08:00.500
Link: CVE-2024-1511
Redhat
No data.
OpenCVE Enrichment
No data.