Arbitrary File Reading Vulnerability in Parisneo/Lollms Application

CVE-2024-3429

What is CVE-2024-3429?

A path traversal vulnerability exists within the lollms application developed by Parisneo, particularly in the sanitize_path_from_endpoint and sanitize_path methods located in the lollms_core\lollms\security.py file. This issue arises from inadequate sanitization of inputs provided by users, allowing malicious actors to bypass intended protections against path traversal. When the application operates on a Windows environment, an attacker can exploit this vulnerability to achieve arbitrary file reading capabilities. This exploitation could result in unauthorized access to sensitive files, revealing confidential information, and may also provoke denial of service (DoS) situations by leveraging resource-heavy files. The vulnerability impacts versions up to 9.5.

References