CVE-2024-6281

N/A

Description

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

CVE Details

CVSS v3.1 ScoreN/A

Published7/20/2024

Last Modified10/15/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-22

References

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(security@huntr.dev)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(security@huntr.dev)

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(af854a3a-2127-422b-91ae-364da2661108)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.