Arbitrary File Reading Vulnerability in Parisneo/Lollms Application

CVE-2024-3429

What is CVE-2024-3429?

A path traversal vulnerability exists within the lollms application developed by Parisneo, particularly in the sanitize_path_from_endpoint and sanitize_path methods located in the lollms_core\lollms\security.py file. This issue arises from inadequate sanitization of inputs provided by users, allowing malicious actors to bypass intended protections against path traversal. When the application operates on a Windows environment, an attacker can exploit this vulnerability to achieve arbitrary file reading capabilities. This exploitation could result in unauthorized access to sensitive files, revealing confidential information, and may also provoke denial of service (DoS) situations by leveraging resource-heavy files. The vulnerability impacts versions up to 9.5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References