GitHub Advisoryadvisory · PyPI

GHSA-6h64-g7cj-hj56 Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

MEDIUM Published 2024-10-11 Modified 2024-10-11 Official page ↗
Aliases
CVE-2024-6985
Ecosystem
PyPI
Packages
lollms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-23
Reviewed
2024-10-11

Affected packages

• PyPI lollms: <= 9.5.1 (no fix yet)

Description

A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.

Related

Alias · CVE (1)

  • CVE-2024-6985 A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References