Stored XSS Vulnerability in Parisneo's Lollms-webui Application

CVE-2024-2299

What is CVE-2024-2299?

The Lollms-WebUI application developed by Parisneo has a stored Cross-Site Scripting (XSS) vulnerability resulting from inadequate validation of uploaded files in the profile picture upload feature. This flaw allows attackers to upload malicious HTML files embedded with JavaScript code. When these files are accessed, the harmful scripts are executed in the context of the application. This vulnerability can be exploited remotely through Cross-Site Request Forgery (CSRF), enabling attackers to conduct actions on behalf of authenticated users and potentially gain unauthorized access to sensitive data stored within the Lollms-WebUI application.

References