CSRF Vulnerability in Lollms Profile Picture Upload Could Lead to Unauthorized File Uploads and Stored XSS

CVE-2024-2288

What is CVE-2024-2288?

The Lollms application, developed by ParisNeo, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in its profile picture upload feature. This vulnerability allows malicious actors to alter a victim's profile image without proper consent. Such unauthorized modifications can lead to a denial of service by saturating the filesystem with excessive file uploads. Furthermore, the vulnerability can serve as a vector for stored cross-site scripting (XSS) attacks, which give attackers the capability to run arbitrary JavaScript within the victim's browser context. The issue has been rectified in Lollms version 9.3.

References