What is CVE-2024-8736?

CVE-2024-8736 is a medium-severity vulnerability in Lollms Web Ui, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.5/10. Published 2025-03-20.

How severe is CVE-2024-8736?

Medium severity. CVSS v3 base score is 6.5 out of 10.

CSRF in Lollms Web Ui

CVE-2024-8736

A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely via Cross-Site Request Forgery (CSRF). Despite CSRF protection preventing file uploads, the application still processes multipart boundaries, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability is present in the `/upload_avatar`, `/upload_app`, and `/upload_logo` endpoints.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.002 (13.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Affected products

Lollms Lollms_web_ui — versions 12
Parisneo Parisneo/lollms-webui — versions unspecified

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security@huntr.dev (Exploit)

Frequently asked questions

What is CVE-2024-8736?: CVE-2024-8736 is a medium-severity vulnerability in Lollms Web Ui, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.5/10. Published 2025-03-20.
How severe is CVE-2024-8736?: Medium severity. CVSS v3 base score is 6.5 out of 10.