Path Traversal in Linux Kernel
CVE-2024-2362
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.
EPSS: 0.011 (63.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Linux Linux_kernel
- Lollms Lollms_web_ui — versions 9.3
- Microsoft Windows
- Parisneo Parisneo/lollms-webui — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-2362?
- CVE-2024-2362 is a critical-severity vulnerability in Linux Kernel, classified under Absolute Path Traversal. CVSS score: 9.1/10. Published 2024-06-06.
- How severe is CVE-2024-2362?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2024-2362 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.