A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.
The vulnerability lies in the `sanitize_path_from_endpoint` and `sanitize_path` functions in the file `lollms_core\lollms\security.py`. The mechanisms for sanitizing user-supplied input are insufficient, allowing an attacker to craft malicious input that bypasses path traversal protections. This makes it possible to escape the application's allowed directory and read arbitrary files available on the Windows system.
An attacker can gain unauthorized access to sensitive system files and cause information disclosure. Intentionally including a large number of resource-intensive files can additionally trigger a denial of service (DoS) condition.
Update lollms to version 9.6 or newer. The fix was introduced in commit f4424cfc3d6dfb3ad5ac17dd46801efe784933e9 in the GitHub repository. Details available at: https://github.com/parisneo/lollms/commit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9
Application parisneo/lollms — all versions prior to version 9.6 running on the Windows platform.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLollms
APPLollms< 9.6
Related vulnerabilities
Stored XSS w funkcji create_post platformy lollms — przejęcie konta
Słaby klucz JWT umożliwia privilege escalation w parisneo/lollms
Brak uwierzytelnienia w endpoint /api/files/extract-text w Lollms
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to acc...
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specific...