A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lollms |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-43968 | A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 09 Jul 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lollms
Lollms lollms Web Ui |
|
| CPEs | cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Lollms
Lollms lollms Web Ui |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T20:40:46.028Z
Reserved: 2024-04-29T19:18:48.950Z
Link: CVE-2024-4326
Vulnrichment
Updated: 2024-08-01T20:40:46.028Z
NVD
Status : Analyzed
Published: 2024-05-16T09:15:16.887
Modified: 2025-07-09T14:29:46.210
Link: CVE-2024-4326
Redhat
No data.
OpenCVE Enrichment
No data.