CVE-2024-9919 Missing Authentication Check in parisneo/lollms-webui
Attackers can delete directories without authentication due to a missing check in the uninstall endpoint of lollms-webui.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9919?
CVE-2024-9919 is a high-severity missing authorization vulnerability in parisneo/lollms-webui, published on 20 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabling attackers to delete directories without proper authentication.
Weakness: CWE-306
Which versions are affected by CVE-2024-9919?
It affects 1 product.
Products include Lollms Lollms Web Ui.
How do I fix CVE-2024-9919?
No fix has been published for CVE-2024-9919 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-9919 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9919 exists.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
Sources
Also known as GHSA-6w2c-f4vg-j9hv.