{"id":"CVE-2024-10047","aliases":["EUVD-2025-7123","GHSA-h9m7-c24m-gqr9"],"status":"published","title":"Directory Listing Vulnerability in parisneo/lollms-webui","description":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01033,"percentile":0.64008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-36"],"published":"2025-03-20T10:09:35Z","modified":"2026-06-17T06:54:49Z","products":[{"vendor":"lollms","product":"lollms_web_ui"},{"vendor":"parisneo","product":"parisneo/lollms-webui"}],"references":[{"url":"https://huntr.com/bounties/69c3a27c-bd93-4aff-a46b-56798f28a3ce","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10047"},{"url":"https://github.com/advisories/GHSA-h9m7-c24m-gqr9"}],"sources":{"cve":[{"id":"CVE-2024-10047","title":"Directory Listing Vulnerability in parisneo/lollms-webui","description":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.","status":"published","published":"2025-03-20T10:09:35.799Z","modified":"2025-03-20T18:37:08.644Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2025-7123","description":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.","status":"published","published":"2025-03-20T10:09:35Z","modified":"2025-03-20T18:37:08Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:57.377828Z"}],"ghsa":[{"id":"GHSA-h9m7-c24m-gqr9","title":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing...","description":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.","status":"published","published":"2025-03-20T12:32:38Z","modified":"2025-03-20T12:32:44Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T15:00:22.529672Z"}],"nvd":[{"id":"CVE-2024-10047","description":"parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.","status":"published","published":"2025-03-20T10:15:14.36Z","modified":"2026-06-17T06:54:49.84Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:10:45.815983Z"}]}}