PT-2025-12238 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-8581

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 (Strawberry)

Description The issue concerns a function named upload app that does not properly filter user input for the filename value, leading to a Path Traversal error. This allows an attacker to delete any file or directory on the system.

Recommendations For parisneo/lollms-webui version V12 (Strawberry), consider disabling the upload app function until a patch is available to prevent potential exploitation. Restrict access to sensitive files and directories to minimize the risk of deletion.

Exploit

Fix

Path traversal

Code Injection

Weakness Enumeration

CWE-22

CWE-94

Related Identifiers

CVE-2024-8581

Affected Products

Parisneo/Lollms-Webui

References · 5

• 🔥 https://huntr.com/bounties/67ead5b9-8149-4001-a1cd-ac648cb7b414 · Exploit
• https://github.com/parisneo/lollms-webui/commit/dcc078cbe20d2a9640b0942a622134b0e3fa6e48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8581 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8581 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902968905150374121 · Twitter Post