CVE-2024-4881 Path Traversal in parisneo/lollms
Attackers can exploit improper path validation to read or delete sensitive files on Windows systems via the /user_infos endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4881?
CVE-2024-4881 is a high-severity path traversal vulnerability in parisneo/lollms, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read any file on the Windows system. Specifically, the application fails to adequately sanitize file paths containing backslashes (`\`), which can be exploited to access the root directory and read, or even delete, sensitive files. This issue was discovered in the context of the `/user_infos` endpoint, where a crafted request using backslashes to reference a file (e.g., `\windows\win.ini`) could result in unauthorized file access. The impact of this vulnerability includes the potential for attackers to access sensitive information such as environment variables, database files, and configuration files, which could lead to further compromise of the system.
Which versions are affected by CVE-2024-4881?
3 open source packages ship an affected version, including lollms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lollms PyPI | All versions | 5.9.0 |
lollms PyPI | All versions | 9.5.0 |
lollms PyPI | All versions | 9.5.0 |
Products include Lollms Lollms.
How do I fix CVE-2024-4881?
Upgrade lollms to a fixed version for your release line: 5.9.0 or 9.5.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-4881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4881 exists.
Other vulnerabilities in parisneo/lollms
- CVE-2026-1114 Improper Access Control via Weak JWT Token in parisneo/lollms
- CVE-2024-3429 Path Traversal in parisneo/lollms
- CVE-2026-1115 Stored XSS in parisneo/lollms
- CVE-2026-12228 Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms
- CVE-2026-0562 Insecure Direct Object Reference (IDOR) in parisneo/lollms
Sources
Also known as GHSA-p8h7-c8gw-6x8c, PYSEC-2024-108.