Path Traversal in parisneo/lollms-webui

published 2024-05-30 2 y ago modified 2026-07-07 4 mo ago also GHSA-9p73-x86v-jw57 , PYSEC-2026-1589 , EUVD-2024-2008

cvss: 4.0; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits: 0; none known

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.

Patch / fix

fixed in 1 links 2

lollms lollms_web_ui 9.8

github.com/ParisNeo/lollms@0e52d59 commit
huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7 advisory

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-06-07)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	4.0	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub	3.0	4.0	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OSV	3.0	4.0	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	lollms	1 listed version	no fix listed

Affected products

parisneo parisneo/lollms-webui
parisneo lollms-webui

Classification

Weakness

CWE-23 Relative Path Traversal

References

huntr.com /bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7
web, exploit, issue-tracking, patch, third-party-advisory
github.com /ParisNeo/lollms/commit/0e52d59a06b7f05e3b2611ce7b053fafa44143a9
web
nvd.nist.gov /vuln/detail/CVE-2024-4330
advisory
github.com /ParisNeo/lollms
package
pypi.org /project/lollms
package
github.com /advisories/GHSA-9p73-x86v-jw57
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary