CVE-2024-4320

The vulnerability results from improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method called by the `@router.post("/install_extension")` route handler. An attacker sends a crafted `name` parameter that causes the server to load and execute the `__init__.py` file from any location in the filesystem — for example from the discussion upload directory. This is a Local File Inclusion (LFI) case leading directly to arbitrary code execution.

An attacker can remotely execute arbitrary code on the server without authentication, leading to complete system compromise, including violation of confidentiality, integrity and availability of data.

Apply patches available from the vendor according to references. As a temporary measure, it is recommended to restrict access to the '/install_extension' endpoint only to trusted networks or users and avoid exposing the application on external network interfaces.

Latest version of parisneo/lollms-webui application — particularly installations accessible from an external network endpoint or running in headless mode