parisneo/lollms · Security
Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
- GHSA ID
- GHSA-6h64-g7cj-hj56
- CVE ID
- CVE-2024-6985
- Severity
- medium
- Published
- Updated
- CVSS
- 4.4 · CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 4.4 · CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
CWEs
- CWE-23 · Relative Path Traversal