PT-2024-33098 · Parisneo · Lollms-Webui

Published 2024-06-23 · Updated 2025-11-07 · CVE-2024-4841

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions v9.6 through the latest

Description A Path Traversal issue exists due to the lack of input sanitization in the add reference to local mode function. This allows an attacker to predict the folders, subfolders, and files present on the victim's computer by exploiting how the application handles the path parameter in HTTP requests to the "/add reference to local model" endpoint.

Recommendations For versions v9.6 through the latest, as a temporary workaround, consider disabling the add reference to local mode function until a patch is available. Restrict access to the "/add reference to local model" endpoint to minimize the risk of exploitation. Avoid using the path parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-4841

Affected Products

Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4841 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4841 · Vendor Advisory
• https://t.me/cvenotify/127878 · Telegram Post
• https://t.me/cvenotify/84127 · Telegram Post
• https://t.me/cveNotify/142115 · Telegram Post