PT-2024-20009 · Parisneo · Lollms-Webui

Published 2024-05-16 · Updated 2025-07-09 · CVE-2024-2366

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version latest

Description A remote code execution issue exists due to insufficient path sanitization in the reinstall binding functionality. This allows an attacker to exploit path traversal and navigate to arbitrary directories. By manipulating the binding path to point to a controlled directory and uploading a malicious init .py file, an attacker can execute arbitrary code on the server.

Recommendations For the latest version, consider disabling the reinstall binding functionality until a patch is available to prevent exploitation. Restrict access to the lollms binding infos.py endpoint to minimize the risk of arbitrary code execution. Avoid using the binding path variable in the affected endpoint until the issue is resolved.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-2366

Affected Products

Lollms-Webui

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-2366 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2366 · Vendor Advisory
• https://huntr.com/bounties/63266c77-408b-45ff-962c-8163db50a864 · Patch
• https://t.me/cvenotify/128187 · Telegram Post