Parisneo Lollms Path Traversal Vulnerability

CVE-2024-6281

Summary

The vulnerability in the Lollms product is attributed to inadequate validation in the 'sanitize_path' function, specifically regarding the 'discussion_db_name' parameter within the 'apply_settings' function. This flaw permits an attacker to traverse system directories, potentially gaining unauthorized access to sensitive files and modifying critical system configurations. It is crucial for users to upgrade to version 9.5.1 or later to mitigate this security risk.

References