PT-2025-12184 · Unknown · Parisneo/Lollms-Webui

Publicado 2025-03-20 · Atualizado 2025-03-21 · CVE-2024-7058

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions v10 through latest

Description A vulnerability in the sanitize path function allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personality folder on the victim's computer.

Recommendations For parisneo/lollms-webui versions v10 through latest, as a temporary workaround, consider disabling the sanitize path function until a patch is available. Restrict access to the personality folder to minimize the risk of exploitation. Avoid using relative paths in the affected function until the issue is resolved.

Exploit

Correção

Relative Path Traversal

Enumeração de Fraquezas

CWE-23

Identificadores relacionados

CVE-2024-7058

Produtos afetados

Parisneo/Lollms-Webui

Referências · 4

• 🔥 https://huntr.com/bounties/148fce03-0f5a-4939-b636-b7f9848765e4 · Exploit
• https://twitter.com/CVEnew/status/1902968874343207371 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-7058 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-7058 · Aviso do Fabricante