CVE-2024-6281 Information

Description

A path traversal vulnerability exists in the apply_settings function of parisneo/lollms versions prior to 9.5.1. The sanitize_path function does not adequately secure the discussion_db_name parameter allowing attackers to manipulate the path and potentially write to important system folders.

Reference

https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61 https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092