CVE-2024-6250
Absolute Path Traversal in parisneo/lollms-webui
概要
Absolute Path Traversal in parisneo/lollms-webui
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com