Path Sanitization Flaw in parisneo Lollms Web UI

CVE-2024-7058

Summary

A security vulnerability in the sanitize_path function of parisneo's Lollms Web UI version 10 allows an attacker to leverage relative paths, such as './', to bypass standard path sanitization. This flaw potentially leads to unauthorized access to sensitive directories within the victim's personality_folder, which could compromise the integrity and confidentiality of the system. Prompt awareness and mitigation are crucial to prevent exploitation of this vulnerability.

References