CVE-2024-10019

MEDIUM

Path Traversal and OS Command Injection in parisneo/lollms-webui

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-10019 has a selected CVSS score of 6.7 (medium).

Description

A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

parisneo/lollms-webui

Browse parisneo / parisneo/lollms-webui
CVE ListThrough latestaffected

References

2