CVE-2024-7058

Description

A vulnerability in the sanitize_path function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personality_folder on the victim's computer.

Reserved 2024-07-23 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-23 Relative Path Traversal

Product status

Any version
affected

References

huntr.com/bounties/148fce03-0f5a-4939-b636-b7f9848765e4

cve.org (CVE-2024-7058)

nvd.nist.gov (CVE-2024-7058)

Download JSON