CVE-2024-10019
Path Traversal and OS Command Injection in parisneo/lollms-webui
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Path Traversal and OS Command Injection in parisneo/lollms-webui
A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.
Reserved 2024-10-16 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-23 Relative Path Traversal
huntr.com/bounties/3cf80890-2d8a-4fc7-8e0e-6d4bf648b3ea
Support options
