Unauthorized Access to Arbitrary Files on Server via Path Traversal

CVE-2024-6394

Summary

A Local File Inclusion vulnerability is present in Parisneo's Lollms WebUI for versions prior to v9.8, caused by unverified path concatenation within the serve_js function located in app.py. This vulnerability permits attackers to conduct path traversal attacks, enabling them to gain unauthorized access to arbitrary files stored on the server. As a result, sensitive information, such as private SSH keys, configuration files, and source code, may be exposed, posing significant security risks to affected systems.

References