Path Traversal in parisneo/lollms

CVE-2024-5824

Summary

A path traversal vulnerability exists in the /set_personality_config endpoint of the Parisneo Lollms application, specifically in version 9.4.0. This vulnerability allows an attacker to exploit improper handling of file paths to overwrite the configs/config.yaml file. By manipulating this configuration file, an attacker can change critical server properties such as force_accept_remote_access and turn_on_code_validation, ultimately leading to the execution of arbitrary code on the server. This poses significant risks to the security integrity of affected systems.

References