Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

CVE-2024-2624

What is CVE-2024-2624?

A path traversal and arbitrary file upload vulnerability exists within the Parisneo Lollms WebUI application, particularly affecting the @router.get("/switch_personal_path") endpoint. Due to inadequate input sanitization for the path parameter, an attacker can manipulate file system paths, resulting in the capability to upload arbitrary files. This vulnerability not only compromises data security by potentially exposing sensitive personal_data but also allows for overwriting of critical configuration files located in the application's configs directory. The flaw is present in the latest version of the application and can lead to unauthorized access and manipulation of vital user data and settings.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References