CVSS 3.0
9.1 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HCVE-2024-4315
Critical (9.1). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in lollms 9.5.0.
parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-11-01)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vqwr-q6cc-c242 | PyPI | lollms | <9.5.0 | 9.5.0 |
| PYSEC-2026-403 | PyPI | lollms | <9.5.0 | 9.5.0 |