PT-2025-12298 · Unknown · Parisneo/Lollms-Webui
Published
2025-03-20
·
Updated
2025-03-21
·
CVE-2024-9920
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
parisneo/lollms-webui version v12
Description
The issue arises from the 'Send file to AL' function, which allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the "/open file" API endpoint to execute these files. The problem stems from the use of
subprocess.Popen to open files without proper validation, leading to potential remote code execution.Recommendations
For version v12, consider disabling the 'Send file to AL' function until a patch is available. As a temporary workaround, restrict access to the "/open file" API endpoint to minimize the risk of exploitation. Avoid using the
subprocess.Popen function to open files without proper validation until the issue is resolved.Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Parisneo/Lollms-Webui