Critical · published February 2, 2026
🔥 A crafty injection into the `name` parameter could turn your server into a playground for attackers! Think of this vulnerability like leaving the front door wide open for anyone with a clever story to talk their way inside. An attacker simply changes the `name` parameter, and suddenly, they can run any Python file they fancy from your upload directory, just like a guest accessing your private stash of secrets! This could be absolutely devastating! An attacker could execute arbitrary code, create a reverse shell, or wreak havoc on your system without needing any user interaction. If your application is exposed on external endpoints—especially in headless mode—you're practically rolling out the welcome mat for intruders!
Think of this vulnerability like leaving the front door wide open for anyone with a clever story to talk their way inside. An attacker simply changes the `name` parameter, and suddenly, they can run any Python file they fancy from your upload directory, just like a guest accessing your private stash of secrets! The Local File Inclusion (LFI) vulnerability arises from improper handling of the `name` parameter in the '/reinstall_extension' endpoint. By concatenating `data.name` with a server path, attackers can load and execute arbitrary Python files, leading to full Remote Code Execution (RCE).
This could be absolutely devastating! An attacker could execute arbitrary code, create a reverse shell, or wreak havoc on your system without needing any user interaction. If your application is exposed on external endpoints—especially in headless mode—you're practically rolling out the welcome mat for intruders! Immediately patch the parisneo/lollms-webui application to the latest version and ensure the server isn't exposed externally. Also, consider implementing stringent input validation to sanitize the `name` parameter and restrict access to sensitive directories. 🔒 You've got this! Stay vigilant, follow the action items, and you'll have your security fortified in no time! 🛡️