Read the docs
TI-2024-01742 Aliases CVE-2024-1873GHSA-7gj2-fqjh-c4qg

Path Traversal and Denial of Service in parisneo/lollms-webui

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.13389 96th percentileScored 2026-11-07
Fix Fixed parisneo/lollms-webui (parisneo): v9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parisneoparisneo/lollms-webuibefore v9.3v9.3Patch availableCNA
  • parisneo/lollms-webui Vendorparisneo Affected before v9.3 Fixed in v9.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lollms:lollms_web_ui:-:*:*:*:*:*:*:*not specified by NVDVulnerableLollms
  • cpe:2.3:a:lollms:lollms_web_ui:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lollms

Remediation

  • Fix · CNA parisneo/lollms-webui (parisneo) Fixed in v9.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1873
  2. 2026-10-03 Alias added: GHSA-7gj2-fqjh-c4qg

References

Advisory 1

Other 1

  • TI-2026-00842 Improper Access Control via Weak JWT Token in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-05059 Remote Code Execution via Path Traversal in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui CVSS 3.0CRITICAL 9.8
  • TI-2024-04023 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
  • TI-2024-03798 Arbitrary Code Execution in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-02196 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui CVSS 3.0CRITICAL 9.6
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences