GitHub Advisoryadvisory · PyPI

GHSA-9chm-m6x2-6fvc lollms vulnerable to path traversal due to unauthenticated root folder settings change

HIGH Published 2024-06-27 Modified 2024-06-28 Official page ↗
Aliases
CVE-2024-6085
Ecosystem
PyPI
Packages
lollms
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-22
Reviewed
2024-06-28

Affected packages

• PyPI lollms: <= 9.5.1 (no fix yet)

Description

A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be bypassed by changing the root folder to '/'. This allows attackers to read arbitrary files on the system. Additionally, the output folders can be changed to write arbitrary audio files to any location on the system.

Related

Alias · CVE (1)

  • CVE-2024-6085 A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References