CVE-2024-9920

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-9920

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9920.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-9920

Published

2025-03-20T10:10:08.169Z

Modified

2026-07-15T01:48:53.784156740Z

Severity

6.6 (Medium) CVSS_V3 - CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Unrestricted File Upload and Execution in parisneo/lollms-webui

Details

In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/open_file' API endpoint to execute these files. The vulnerability arises from the use of 'subprocess.Popen' to open files without proper validation, leading to potential remote code execution.

Database specific

{
    "cwe_ids": [
        "CWE-434"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9920.json"
}

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type

GIT

Repo

https://github.com/parisneo/lollms-webui

Events

Introduced

da47cb36445a0809e383e586e76353c6975e3498

Last affected

da47cb36445a0809e383e586e76353c6975e3498

Database specific

{
    "cpe": "cpe:2.3:a:lollms:lollms_web_ui:12:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "12"
        },
        {
            "last_affected": "12"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

Other

v12

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9920.json"