PT-2025-12248 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 (Strawberry)

Description A path traversal issue exists in the API endpoints for installation and uninstallation. This allows attackers to create or delete directories with arbitrary paths on the system. The problem arises due to insufficient sanitization of user-supplied input, which can be exploited to navigate directories outside the intended path. The install and uninstall API endpoints are specifically affected.

Recommendations For parisneo/lollms-webui version V12 (Strawberry), consider disabling the install and uninstall API endpoints until a patch is available to prevent exploitation of the path traversal vulnerability. Restrict access to these endpoints to minimize the risk of directory creation or deletion with arbitrary paths.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-8898

Affected Products

Parisneo/Lollms-Webui

References · 5

• 🔥 https://huntr.com/bounties/6072371f-0ddc-42e3-9207-1c6d6b18d32f · Exploit
• https://github.com/parisneo/lollms-webui/commit/6d07c8a0dd0a15cc060becc73fda9fe8e788eb23 · Patch
• https://osv.dev/vulnerability/CVE-2024-8898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8898 · Security Note
• https://twitter.com/CVEnew/status/1902671046500577345 · Twitter Post