CVE-2024-1600

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-1600

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1600.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-1600

Published

2024-04-10T17:15:52.317Z

Modified

2026-03-14T12:30:42.714695Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L CVSS Calculator

Summary

[none]

Details

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (../../) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type

GIT

Repo

https://github.com/parisneo/lollms-webui

Events

Introduced

80d72ca433cf0cb8318e0d08fa774b608aa29f05

Fixed

e2f2d313cd6ea3fe81dfc4496f985f5b650853b9

Fixed

49b0332e98d42dd5204dda53dee410b160106265

Database specific

{
    "versions": [
        {
            "introduced": "9.0"
        },
        {
            "fixed": "9.6"
        }
    ]
}

Affected versions

v9.*

v9.0

v9.1

v9.2

v9.3

v9.4

v9.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1600.json"