Absolute Path Traversal in parisneo/lollms-webui

CVE-2024-6250

What is CVE-2024-6250?

An absolute path traversal vulnerability has been identified in the Parisneo Lollms WebUI version 9.6. This issue resides in the open_file endpoint of the lollms_advanced.py module. Due to the misconfiguration of the sanitize_path function, which has allow_absolute_path set to true, an attacker could exploit this vulnerability to access arbitrary files and directories on a Windows operating system. Consequently, this vulnerability enables potential unauthorized file reads and directory listings, posing a significant security risk to the affected installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References