Unauthorized Access to Arbitrary Files on Server via Path Traversal
CVE-2024-6394
7.5HIGH
What is CVE-2024-6394?
A Local File Inclusion vulnerability is present in Parisneo's Lollms WebUI for versions prior to v9.8, caused by unverified path concatenation within the serve_js
function located in app.py
. This vulnerability permits attackers to conduct path traversal attacks, enabling them to gain unauthorized access to arbitrary files stored on the server. As a result, sensitive information, such as private SSH keys, configuration files, and source code, may be exposed, posing significant security risks to affected systems.
Affected Version(s)
parisneo/lollms-webui <= unspecified