Arbitrary File Upload and Read Vulnerability in parisneo/lollms-webui

CVE-2024-2361

What is CVE-2024-2361?

A vulnerability in Parisneo's Lollms-Webui facilitates arbitrary file uploads and reads due to inadequate sanitization of inputs provided by users. The flaw is located in the install_model() function within lollms_core/lollms/binding.py, which does not properly handle the file:// protocol among other inputs. This allows malicious actors to exploit the vulnerability by manipulating the path and variant_name parameters, thus gaining unauthorized access to read arbitrary files and upload files to any location on the server. The vulnerability poses significant risks as it opens pathways for unauthorized data exposure and system compromise.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References