CVE-2024-8581

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8581
A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal error.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/parisneo/lollms-webui/commit/dcc078cbe20d2a9640b0942a622134b0e3fa6e48 Patch
https://huntr.com/bounties/67ead5b9-8149-4001-a1cd-ac648cb7b414 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms_web_ui:12:*:*:*:*:*:*:*
History

08 Jul 2025, 16:05

Type Values Removed Values Added
First Time Lollms
Lollms lollms Web Ui
Summary
  • (es) Una vulnerabilidad en la función `upload_app` de parisneo/lollms-webui V12 (Strawberry) permite a un atacante eliminar cualquier archivo o directorio del sistema. Esta función no implementa el filtrado de la entrada del usuario con el valor `filename`, lo que provoca un error de Path Traversal.
References () https://github.com/parisneo/lollms-webui/commit/dcc078cbe20d2a9640b0942a622134b0e3fa6e48 - () https://github.com/parisneo/lollms-webui/commit/dcc078cbe20d2a9640b0942a622134b0e3fa6e48 - Patch
References () https://huntr.com/bounties/67ead5b9-8149-4001-a1cd-ac648cb7b414 - () https://huntr.com/bounties/67ead5b9-8149-4001-a1cd-ac648cb7b414 - Exploit, Third Party Advisory
CPE cpe:2.3:a:lollms:lollms_web_ui:12:*:*:*:*:*:*:*

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-08 16:05

NVD link : CVE-2024-8581

Mitre link : CVE-2024-8581

CVE.ORG link : CVE-2024-8581

JSON object : View

Products Affected

lollms

  • lollms_web_ui
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')