An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lollms |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17268 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lollms
Lollms lollms Web Ui |
|
| CPEs | cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Lollms
Lollms lollms Web Ui |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:40:21.354Z
Reserved: 2024-02-14T21:45:35.981Z
Link: CVE-2024-1520
Vulnrichment
Updated: 2024-08-01T18:40:21.354Z
NVD
Status : Analyzed
Published: 2024-04-10T17:15:51.930
Modified: 2025-07-09T14:14:56.047
Link: CVE-2024-1520
Redhat
No data.
OpenCVE Enrichment
No data.