HIGH 7.4 PyPI
lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
GHSA-m45c-v46h-c788 · CVE-2024-5824
Published · Modified
Description
A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.
Ready to move
Start Securing
Free, no credit card | First findings in minutes