CVE-2024-6281

EUVD-2024-2301
A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
parisneolollms
𝑥
< 9.5.1
ADP
Common Weakness Enumeration
References
https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092
https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61
https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092
https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61