CVE-2024-1873

The `/select_database` endpoint improperly validates file paths provided by users, accepting absolute paths without any restrictions. An attacker can specify any location in the file system when interacting with the `DiscussionsDB` instance, which allows creating directories anywhere the application has permissions. By creating a directory named after critical files (e.g., HTTPS certificates), an attacker can prevent the server from starting correctly. Additionally, constantly changing the database path to a location controlled by the attacker causes client data to be scattered across the entire file system, making recovery difficult.

An attacker can cause service unavailability (denial of service) by disrupting the server startup process, and can also cause permanent data loss for clients by manipulating the database location and scattering its contents across the file system.

The application should be updated to a version containing the fix available in commit 02e829b5653a1aa5dbbe9413ec84f96caa1274e8 in the project's GitHub repository. Additionally, it is recommended to restrict access to the `/select_database` endpoint exclusively to trusted users and implement validation and sanitization of all file paths provided by users.

parisneo/lollms-webui in version a9d16b0