PT-2025-12184 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-7058

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions v10 through latest

Description A vulnerability in the sanitize path function allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personality folder on the victim's computer.

Recommendations For parisneo/lollms-webui versions v10 through latest, as a temporary workaround, consider disabling the sanitize path function until a patch is available. Restrict access to the personality folder to minimize the risk of exploitation. Avoid using relative paths in the affected function until the issue is resolved.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-7058

Affected Products

Parisneo/Lollms-Webui

References · 4

• 🔥 https://huntr.com/bounties/148fce03-0f5a-4939-b636-b7f9848765e4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7058 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7058 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902968874343207371 · Twitter Post