CVE-2024-5824

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-5824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-5824
Aliases
Published
2024-06-27T19:15:17Z
Modified
2025-01-15T05:16:56.229073Z
Summary
[none]
Details

A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.

References

Affected packages

Git / github.com/parisneo/lollms

Affected ranges

Type
GIT
Repo
https://github.com/parisneo/lollms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eda3af5f5c4ea9b2f3569f72f8d05989e29367fc
Fixed
eda3af5f5c4ea9b2f3569f72f8d05989e29367fc

Affected versions

v5.*

v5.9.0