GitHub Advisoryadvisory · PyPI

GHSA-w9qf-83jg-2x6c lollms vulnerable to dot-dot-slash path traversal in XTTS server

HIGH Published 2024-06-27 Modified 2024-06-28 Official page ↗
Aliases
CVE-2024-6139
Ecosystem
PyPI
Packages
lollms
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-29
Reviewed
2024-06-28

Affected packages

• PyPI lollms: <= 9.5.1 (no fix yet)

Description

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.

Related

Alias · CVE (1)

  • CVE-2024-6139 A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. vulnerability

Weakness · CWE (1)

  • CWE-29 Path Traversal: '\..\filename' weakness

References