/Vulnerability Library

LoLLMS WebUI < 9.8 - Path Traversal

CVE-2024-4322
Verified

Description

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /list_personalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter.

Severity

High

CVSS Score

7.5

Exploit Probability

31%

Published Date

May 10, 2026

Template Author

mj-bin

CVE-2024-4322.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2024-4322
CWE ID:
cwe-29

References

https://huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209https://nvd.nist.gov/vuln/detail/CVE-2024-4322

Remediation Steps

Implement proper input validation and sanitization for the 'category' parameter; update to the latest version with security patches.