CVE-2024-6281

N/A

Beschreibung

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

CVE Details

CVSS v3.1 BewertungN/A

Veroffentlicht7/20/2024

Zuletzt geandert10/15/2025

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-22

Referenzen

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(security@huntr.dev)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(security@huntr.dev)

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(af854a3a-2127-422b-91ae-364da2661108)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.