CVE-2024-5824CWE-22

Path Traversal in parisneo/lollms

High · published June 27, 2024

CVSS v3.0
7.4
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-06-27T18:45Z
EPSS history
Timeline
  • 27 JUN 18:45Z
    Path Traversal in parisneo/lollms
    cvelistv5