CVE-2024-2356

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-2356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-2356
Published
2026-02-02T10:36:23.820Z
Modified
2026-07-15T01:49:11.648990968Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui
Details

A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the name parameter of the @router.post("/reinstall_extension") route. This vulnerability allows attackers to inject a malicious name parameter, leading to the server loading and executing arbitrary Python files from the upload directory for discussions. This issue arises due to the concatenation of data.name directly with lollmsElfServer.lollms_paths.extensions_zoo_path and its use as an argument for ExtensionBuilder().build_extension(). The server's handling of the __init__.py file in arbitrary locations, facilitated by importlib.machinery.SourceFileLoader, enables the execution of arbitrary code, such as command execution or creating a reverse-shell connection. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to Remote Code Execution (RCE) when the application is exposed to an external endpoint or the UI, especially when bound to 0.0.0.0 or in headless mode. No user interaction is required for exploitation.

Database specific 
{
    "cwe_ids": [
        "CWE-29"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2356.json",
    "cna_assigner": "@huntr_ai"
}
References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type
GIT
Repo
https://github.com/parisneo/lollms-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
41dbb1b3f2e78ea276e5269544e50514252c0c25
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v9.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v3.*
v3.0
v3.5
v4.*
v4.0
v5.*
v5.0
v6.*
v6.0
v6.5
v6.5.0
v6.5rc2
v6.7
v7.*
v7.0
v8.*
v8.5
v9.*
v9.0
v9.1
v9.2
v9.3
v9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2356.json"