CVE-2024-6250
Absolute Path Traversal in parisneo/lollms-webui
Résumé
Absolute Path Traversal in parisneo/lollms-webui
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com