CVE-2024-10019CWE-78

Path Traversal and OS Command Injection in parisneo/lollms-webui

Medium · published March 20, 2025

CVSS v3.0
6.3
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00824 · 56.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Path Traversal and OS Command Injection in parisneo/lollms-webui
    cvelistv5