CVE-2024-6281: LoLLMS vulnerable to Expected Behavior Violation

July 20, 2024 (updated September 13, 2024)

A path traversal vulnerability exists in the apply_settings function of parisneo/lollms versions prior to 9.5.1. The sanitize_path function does not adequately secure the discussion_db_name parameter, allowing attackers to manipulate the path and potentially write to important system folders.

References

github.com/advisories/GHSA-8mrm-r7h3-c3hj
github.com/parisneo/lollms
github.com/parisneo/lollms/commit/26a3ff35acf152b49e1087d5698ad4864c7b6092
huntr.com/bounties/0a62f2fb-4e62-4128-9dc4-e8f1d959ac61
nvd.nist.gov/vuln/detail/CVE-2024-6281

Code Behaviors & Features

Detect and mitigate CVE-2024-6281 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →