High severity · published Jun 27, 2024
CVE-2024-5824
Path Traversal in parisneo/lollms
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parisneo/lollms · parisneo
before latest · source: vendor
LO
Lollms-webui · Parisneo
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5824
github.com
https://github.com/parisneo/lollms/commit/eda3af5f5c4ea9b2f3569f72f8d05989e29367fc
huntr.com
https://huntr.com/bounties/9ceb7cf9-a7cd-4699-b3f8-d0999d2b49fd
More from parisneo/lollms
9.8
CVE-2026-1114
Improper Access Control via Weak JWT Token in parisneo/lollms
9.8
CVE-2026-0558
Unauthenticated File Upload in parisneo/lollms
9.8
CVE-2024-5443
Remote Code Execution via Path Traversal in parisneo/lollms
9.8
CVE-2024-3429
Path Traversal in parisneo/lollms
9.8
CVE-2024-4078
Arbitrary Code Execution in parisneo/lollms