{"id":"CVE-2024-4330","aliases":["EUVD-2024-2008","GHSA-9p73-x86v-jw57","PYSEC-2026-1589"],"status":"published","title":"Path Traversal in parisneo/lollms-webui","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","severity":{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00285,"percentile":0.21161,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-23"],"published":"2024-05-30T14:43:40Z","modified":"2026-10-28T02:30:35Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lollms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.6"},{"last_affected":"9.6"}]}],"versions":["9.6"]},{"source":"osv","ecosystem":"PyPI","package":"lollms","versions":["9.6"]},{"source":"osv","ecosystem":"PyPI","package":"lollms","versions":["9.6"]}],"products":[{"vendor":"lollms","product":"lollms_web_ui"},{"vendor":"parisneo","product":"lollms-webui"},{"vendor":"parisneo","product":"parisneo/lollms-webui"}],"references":[{"url":"https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4330","tags":["advisory"]},{"url":"https://github.com/ParisNeo/lollms/commit/0e52d59a06b7f05e3b2611ce7b053fafa44143a9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9p73-x86v-jw57","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4330.json","tags":["advisory"]},{"url":"https://github.com/ParisNeo/lollms","tags":["package"]},{"url":"https://pypi.org/project/lollms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-4330","title":"Path Traversal in parisneo/lollms-webui","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-05-30T14:43:40.842Z","modified":"2024-08-01T20:40:46.503Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-2008","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-05-30T14:43:40Z","modified":"2024-08-01T20:40:46Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:36.775345Z"}],"ghsa":[{"id":"GHSA-9p73-x86v-jw57","title":"path traversal vulnerability was identified in the parisneo/lollms-webui ","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-06-02T22:30:25Z","modified":"2024-06-02T22:30:26Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:37:53.025064Z"}],"nvd":[{"id":"CVE-2024-4330","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-05-30T15:15:49.89Z","modified":"2026-06-17T08:01:41.143Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-4330","title":"Path Traversal in parisneo/lollms-webui","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-05-30T14:43:40.842Z","modified":"2026-10-28T02:30:35.099678493Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-9p73-x86v-jw57","title":"path traversal vulnerability was identified in the parisneo/lollms-webui ","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2024-06-02T22:30:25Z","modified":"2026-07-07T17:56:57.155154971Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"PYSEC-2026-1589","title":"path traversal vulnerability was identified in the parisneo/lollms-webui ","description":"A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.","status":"published","published":"2026-07-07T11:45:44.318156Z","modified":"2026-07-07T17:47:14.695922218Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}