{"cve":"CVE-2024-2362","nvd":{"published":"2024-06-06T19:15:54.767","modified":"2026-06-17T07:24:23.513","status":"Analyzed","description":"A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-22","CWE-36"],"references":["https://huntr.com/bounties/2433d0a4-9ba0-474b-be1a-6fd5019770ba","https://huntr.com/bounties/2433d0a4-9ba0-474b-be1a-6fd5019770ba"],"products":["lollms:lollms_web_ui"],"source":"nvd","synced_at":"2026-10-19T21:51:20.603330631+00:00"},"epss":{"cve":"CVE-2024-2362","score":0.0115,"percentile":0.66894,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}