We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.
Reserved 2024-04-06 | Published 2024-06-06 | Updated 2024-08-01 | Assigner @huntr_aiCWE-29 Path Traversal: '\..\filename'
huntr.com/bounties/fd8f50c8-17f0-40be-a2c6-bb8d80f7c409
github.com/...ommit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9
Support options