Path Traversal Vulnerability in Lollms-Webui Could Lead to Information Disclosure

CVE-2024-4322

Summary

The vulnerability in the ParisNeo Lollms-WebUI application allows an attacker to exploit the /list_personalities endpoint. By manipulating the category parameter, it is possible to traverse the directory structure of the server. This improper handling of user input can be leveraged to list the contents of sensitive directories, potentially exposing critical information stored on the system. The issue remains present in the latest version of the application, highlighting the need for immediate mitigation measures.

References