GHSA-7pgr-32fx-c6x9LowCVSS 3.4

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

Published
October 11, 2024
Last Modified
October 11, 2024

🔗 CVE IDs covered (1)

📋 Description

A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollms_file_system.py file. The functions add_rag_database, toggle_mount_rag_database, and vectorize_folder do not implement security measures such as sanitize_path_from_endpoint or sanitize_path. This allows an attacker to perform vectorize operations on .sqlite files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.

🎯 Affected products1

  • pip/lollms:<= 9.5.1

🔗 References (4)