CVE-2024-1600

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.

Metrics

CVSS 3.0 9.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-16019.8An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker t CVE-2024-16026.1parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises CVE-2024-16037.5paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.CVE-2024-16046.8Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to re CVE-2024-16057.8BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read CVE-2024-16065.4Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via CVE-2024-16087.5In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application inte CVE-2024-16098.7In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.CVE-2024-16109.8In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.CVE-2024-16187.8A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This CVE-2024-16198.8Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially f CVE-2024-16217.5The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email lo