CVE-2024-6250
Absolute Path Traversal in parisneo/lollms-webui
Summary
Absolute Path Traversal in parisneo/lollms-webui
Original description
The description as published by the source.
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
References
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com