PT-2025-12286 · Unknown · Parisneo/Lollms

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9597

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms version v12

Description A Path Traversal issue exists in the "/wipe database" endpoint, allowing an attacker to delete any directory on the system. This is due to improper validation of the key parameter, which is used to construct file paths. An attacker can exploit this by sending a specially crafted HTTP request to delete arbitrary directories.

Recommendations For parisneo/lollms version v12, as a temporary workaround, consider restricting access to the "/wipe database" endpoint until a patch is available. Additionally, avoid using the key parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-9597

Affected Products

Parisneo/Lollms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-9597 · Security Note
• https://twitter.com/CVEnew/status/1902968894001909845 · Twitter Post
• https://huntr.com/bounties/1f6c8908-d486-4141-be55-25bd29933d8b · Note