PT-2025-12021 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-07-08 · CVE-2024-10019

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 (Strawberry)

Description A vulnerability in the start app server function allows for path traversal and OS command injection. The function does not properly sanitize the app name parameter, enabling an attacker to upload a malicious server.py file and execute arbitrary code by exploiting the path traversal vulnerability.

Recommendations For parisneo/lollms-webui version V12 (Strawberry), as a temporary workaround, consider disabling the start app server function until a patch is available. Restrict access to the app name parameter to minimize the risk of exploitation. Avoid using the app name parameter in the affected function until the issue is resolved.

Exploit

Fix

Relative Path Traversal

OS Command Injection

Weakness Enumeration

CWE-23

CWE-78

Related Identifiers

CVE-2024-10019

Affected Products

Parisneo/Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/3cf80890-2d8a-4fc7-8e0e-6d4bf648b3ea · Exploit
• https://osv.dev/vulnerability/CVE-2024-10019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10019 · Security Note
• https://t.me/cvenotify/128025 · Telegram Post
• https://twitter.com/CVEnew/status/1902671140302303560 · Twitter Post
• https://t.me/cvenotify/115445 · Telegram Post