Skip to content
Fencer Vulns
critical 9.3

CVE-2024-1600 in the critical feed json

Local File Inclusion in parisneo/lollms-webui

published 2024-04-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-17341

cvss
9.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
32.5%
EPSS 32.5% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.

Patch / fix

  • parisneo parisneo/lollms-webui 9.5
  • parisneo lollms-webui 9.5

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

32.51% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Affected products

  • parisneo parisneo/lollms-webui
  • parisneo lollms-webui

Classification

Weakness
  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.