Path Traversal Vulnerability in Lollms-Webui Could Lead to Remote Code Execution

CVE-2024-3435

Summary

A vulnerability exists in the 'save_settings' endpoint of the Lollms-WebUI application due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function. This flaw enables an attacker to exploit the application by sending specially crafted JSON payloads, allowing unauthorized manipulation of application configurations. The vulnerability could be exploited to execute remote code, potentially bypassing security patches designed to protect against such attacks.

References