CVE-2024-6971

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
parisneo	parisneo/lollms	>= unspecified, <= latest
parisneo	lollms	<= 9.9

References

https://huntr.com/bounties/fbfe7cd0-99fb-4305-bd07-8b573364109eExploit, Third Party Advisory

Timeline

Published: Oct 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-69726.5In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in c CVE-2024-69738.8Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34.CVE-2024-69747.8Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.CVE-2024-69758.8Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.CVE-2024-69776.5A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an CVE-2024-69788.8Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users.This issue affects SDP Client: before 5.10 CVE-2024-69797.5Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- an CVE-2024-69809.8A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side r CVE-2024-69819.8OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication.CVE-2024-69828.4A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use CVE-2024-69838.8mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs n CVE-2024-69843.8An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access