What’s Vulnerable › Vulnerabilities
CVE-2024-1511: Path Traversal Vulnerability in parisneo/lollms-webui
- Severity: critical (CVSS 9.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-04-10 · updated 2026-06-17
- Weakness: CWE-22
Description
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Affected products
References
- https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b
- https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b
Get alerted when CVE-2024-1511 or the next vulnerability affects your stack