What is CVE-2024-1511?

CVE-2024-1511 is a critical-severity vulnerability in Lollms Web Ui, classified under Path Traversal. CVSS score: 9.8/10. Published 2024-04-10.

How severe is CVE-2024-1511?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Lollms Web Ui

CVE-2024-1511

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Lollms Lollms_web_ui — versions 9.0
Parisneo Parisneo/lollms-webui — versions unspecified

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-1511?: CVE-2024-1511 is a critical-severity vulnerability in Lollms Web Ui, classified under Path Traversal. CVSS score: 9.8/10. Published 2024-04-10.
How severe is CVE-2024-1511?: Critical severity. CVSS v3 base score is 9.8 out of 10.