CVE-2024-10019 — Path Traversal and OS Command Injection in parisneo/lollms-webui

CVE-2024-10019

Path Traversal and OS Command Injection in parisneo/lollms-webui PUBLISHED

Description (CNA)

A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.

Affected (CNA)

Vendor / product	Versions
parisneo / parisneo/lollms-webui	affected unspecified through latest

CWE

CWE-78

References

https://huntr.com/bounties/3cf80890-2d8a-4fc7-8e0e-6d4bf648b3ea

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.