CVE-2024-2362

The vulnerability results from insufficient validation and sanitization of file paths supplied by the user in the 'del_preset' endpoint. The application does not block the use of absolute paths or directory traversal sequences ('..'), which leads to inconsistencies in path handling between Windows and Linux environments. An attacker can send a specially crafted request to the 'del_preset' endpoint, specifying a path to a file located outside the intended directory, resulting in its deletion.

An unauthenticated attacker can delete any file accessible in the operating system, which may lead to permanent data loss, system destabilization, or complete system unavailability.

Apply patches available from the vendor according to the references (https://huntr.com/bounties/2433d0a4-9ba0-474b-be1a-6fd5019770ba). It is recommended to update to the latest available version of the application and — as a temporary measure — restrict network access to the 'del_preset' endpoint using firewall or authorization mechanisms.

parisneo/lollms-webui version 9.3 running on the Windows platform