CVE-2024-6139CWE-29

Path Traversal in parisneo/lollms

High · published June 27, 2024

CVSS v3.0
7.3
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-29 · Path Traversal: '\..\filename'
Published
2024-06-27T18:45Z
EPSS history
Timeline
  • 27 JUN 18:45Z
    Path Traversal in parisneo/lollms
    cvelistv5