CVE-2024-4326: Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-16 · updated 2026-06-17
Weakness: CWE-15

Description

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.

Affected products

ParisNeo lollms-webui: before 9.5 — fixed in 9.5

How to fix

Upgrade to a fixed version: ParisNeo lollms-webui 9.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4326 or the next vulnerability affects your stack