Description
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| parisneo | parisneo/lollms-webui | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-47374 | An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system. |
References
History
Wed, 09 Jul 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lollms
Lollms lollms Web Ui |
|
| CPEs | cpe:2.3:a:lollms:lollms_web_ui:9.6:*:*:*:*:*:*:* | |
| Vendors & Products |
Lollms
Lollms lollms Web Ui |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T21:33:05.318Z
Reserved: 2024-06-21T15:10:43.910Z
Link: CVE-2024-6250
Vulnrichment
Updated: 2024-08-01T21:33:05.318Z
NVD
Status : Analyzed
Published: 2024-06-27T19:15:20.280
Modified: 2025-07-09T14:23:34.807
Link: CVE-2024-6250
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses