CVE-2024-6281 Path Traversal in parisneo/lollms
Attackers can exploit a path traversal flaw in the apply_settings function to write files to arbitrary system locations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-6281?
CVE-2024-6281 is a high-severity path traversal vulnerability in parisneo/lollms, published on 20 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.
Weakness: CWE-22
Which versions are affected by CVE-2024-6281?
3 open source packages ship an affected version, including lollms.
| Package | Affected | Fixed in |
|---|---|---|
lollms PyPI | All versions | 9.5.1 |
lollms PyPI | All versions | 9.5.1 |
lollms PyPI | All versions | 9.5.1 |
How do I fix CVE-2024-6281?
Upgrade lollms to 9.5.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-6281 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6281 exists.
Sources
Also known as GHSA-8mrm-r7h3-c3hj, PYSEC-2026-1587.