CVE Feed

    Dashboard / CVE / CVE-2024-4841

    CVE-2024-4841

    A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.

    Published:Jun 23, 2024
    Last Modified:Nov 7, 2025
    EPS:Jun 23, 2024
    EPSS Score:0.071
    CVSS Score:3.3

    Affected Products

    Vendor
    Lollms
    Product
    Lollms-webui

    Exploits

    https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602https://huntr.com/bounties/740dda3e-7104-4ccf-9ac4-8870e4d6d602

    Common Weakness Enumeration

    CWE-29 Path Traversal: '..filename'

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-5125 (CVSS 7.3) — parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequ…
    CVE-2024-6971 (CVSS 4.4) — A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_fil…
    CVE-2024-4839 (CVSS 3.3) — A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the paris…
    CVE-2024-4403 (CVSS 8.8) — A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollm…
    CVE-2024-4267 (CVSS 9.8) — A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open…
    CVE-2024-1569 (CVSS 7.5) — parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumpti…
    CVE-2024-1601 (CVSS 9.8) — An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui appli…
    CVE-2024-1646 (CVSS 8.2) — parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive end…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High