Absolute Path Traversal in parisneo/lollms-webui

CVE-2024-6250

Summary

An absolute path traversal vulnerability has been identified in the Parisneo Lollms WebUI version 9.6. This issue resides in the open_file endpoint of the lollms_advanced.py module. Due to the misconfiguration of the sanitize_path function, which has allow_absolute_path set to true, an attacker could exploit this vulnerability to access arbitrary files and directories on a Windows operating system. Consequently, this vulnerability enables potential unauthorized file reads and directory listings, posing a significant security risk to the affected installations.

References