Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-9920

In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/open_file' API endpoint to execute these files. The vulnerability arises from the use of 'subprocess.Popen' to open files without proper validation, leading to potential remote code execution.

Published

2025-03-20T10:15:50.787

Last Modified

2025-04-03T18:02:58.177

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-434
  • Type: Primary
    CWE-434
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application lollms lollms_web_ui 12 Yes
References