by Kastro
Paper/Archive/CVE-2024-8581

CVE-2024-8581

parisneo parisneo/lollms-webui — Path Traversal in parisneo/lollms-webui

EPSS 1.0%public exploitCVSS 9.1
critical.is priorityof 100
50
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 62.0.620 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal error.

Affected

ProductAffectedFixed inSource
parisneo/lollms-webuiunspecified – < v14v14CNA

Scores by source

@huntr_ai (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refhuntr.com/bounties/67ead5b9-8149-4001-a1cd-ac648cb7b414refgithub.com/parisneo/lollms-webui/commit/dcc078cbe20d2a9640b0942a622134b0e3fa6e48