Arbitrary File Reading Vulnerability in Parisneo/Lollms Application
CVE-2024-3429
Key Information:
- Vendor
- Parisneo
- Status
- Parisneo/lollms
- Vendor
- CVE Published:
- 6 June 2024
Summary
A path traversal vulnerability exists within the lollms application developed by Parisneo, particularly in the sanitize_path_from_endpoint
and sanitize_path
methods located in the lollms_core\lollms\security.py
file. This issue arises from inadequate sanitization of inputs provided by users, allowing malicious actors to bypass intended protections against path traversal. When the application operates on a Windows environment, an attacker can exploit this vulnerability to achieve arbitrary file reading capabilities. This exploitation could result in unauthorized access to sensitive files, revealing confidential information, and may also provoke denial of service (DoS) situations by leveraging resource-heavy files. The vulnerability impacts versions up to 9.5.
Affected Version(s)
parisneo/lollms < 9.6
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved