CVE-2024-6281

N/A

Descricao

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado7/20/2024

Ultima modificacao10/15/2025

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-22

Referencias

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(security@huntr.dev)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(security@huntr.dev)

https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092(af854a3a-2127-422b-91ae-364da2661108)

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.