CVE-2024-6281

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Score

CVSS 3.0 7.3 High

Status

Deferred - security@huntr.dev

Published

2024-07-20

Last modified

2025-10-15

Weaknesses

CWE-22

Affected products

• Lollms (Parisneo)
• Parisneolollms (Parisneo)

References

• https://github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092
• https://huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61