CVE-2024-4841

LOWNuclei

Path Traversal in parisneo/lollms-webui

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-4841 has a selected CVSS score of 3.3 (low); EIP currently links 1 Nuclei template.

Description

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 11, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

lollms-webui

Browse lollms / lollms-webui
VulnCheckVersion data not supplied

lollms-webui

Browse parisneo / lollms-webui

Default status: unknown

CVE List9.6 to ≤ *affected

parisneo/lollms-webui

Browse parisneo / parisneo/lollms-webui
CVE ListThrough latestaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMLoLLMS WebUI - Subfolder Prediction via Path TraversalCVSS 4

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest.

Impact

By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-29
Authorss4e-io
Template tagscvecve2024lollms-webuitraversalvulnaivkev
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
FOFA: LoLLMS WebUI - Welcome
https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602 https://nvd.nist.gov/vuln/detail/CVE-2024-4841

Source: ProjectDiscovery

References

2