Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

published 2024-06-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-27313

cvss: 9.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-06-07)

Exploit prediction

1.87% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/65d0ef59-a761-4bbd-86fa-dd8e8621082e referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

parisneo parisneo/lollms-webui
parisneo lollms-webui

Classification

Weakness

CWE-29 Path Traversal: '\..\filename'
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

huntr.com /bounties/65d0ef59-a761-4bbd-86fa-dd8e8621082e
exploit, third-party-advisory

Sources

CVE List CVE-2024-2360
NVD CVE-2024-2360

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary