GHSA-m45c-v46h-c788HighCVSS 7.4

lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

Published
June 27, 2024
Last Modified
June 28, 2024

🔗 CVE IDs covered (1)

📋 Description

A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.

🎯 Affected products1

  • pip/lollms:< 9.5.0

🔗 References (4)