CVE-2024-2360

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-29CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-236002.7Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficientCVE-2024-236019.8A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bCVE-2024-236033.8An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reCVE-2024-236046.1Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrarCVE-2024-236059.8A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially craCVE-2024-236069.8An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (aCVE-2024-236075.5A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKViewCVE-2024-236087.8An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an atCVE-2024-236097.8An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to prCVE-2024-23619.6A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied inpCVE-2024-236107.8An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attCVE-2024-236117.8An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an att