CVSS 3.1
4.4 mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVE-2024-6985
Medium (4.4) in lollms lollms. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in lollms 5.9.0.
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWE
- CWE-23
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lollms:lollms
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6h64-g7cj-hj56 | PyPI | lollms | <=9.5.1 | no fix published |
| PYSEC-2024-122 | PyPI | lollms | <5.9.0 | 5.9.0 |