Path Traversal Vulnerability in parisneo/lollms-webui

CVE-2024-8581

Summary

A security flaw exists in the upload_app function of parisneo/lollms-webui version 12 (Strawberry) that permits unauthorized file or directory deletion on the server. The lack of proper filtering for user input related to the filename leads to a path traversal vulnerability, allowing attackers to manipulate file paths and execute malicious commands, resulting in potential data loss or disruption.

References