CVE-2024-6281

N/A

Descripcion

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Detalles CVE

Puntuacion CVSS v3.1N/A

Publicado7/20/2024

Ultima modificacion10/15/2025

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-22

Referencias

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(security@huntr.dev)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(security@huntr.dev)

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(af854a3a-2127-422b-91ae-364da2661108)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.