A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
The vulnerability results from insufficient validation and sanitization of the `model` parameter used in the model deletion process. An attacker can craft an HTTP request containing a manipulated `model` parameter with path traversal sequences (e.g., `../../`), which causes the operation to escape the intended directory. As a result, the deletion mechanism operates on files outside the allowed working directory, enabling deletion of arbitrary files accessible to the application process.
An attacker can permanently delete arbitrary files on the server accessible to the application process, including configuration files, user data, or critical system files, leading to data integrity loss and potential service unavailability.
LocalAI should be updated to a version containing the patch available in commit 1a3dedece06cab1acc3332055d285ac540a47f0e in the GitHub repository. Details available at: https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e
mudler/LocalAI version 2.14.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HMudler Localai
APPMudler< 2.16.0
Related vulnerabilities
Podatność tarslip w LocalAI umożliwiająca RCE przez arbitralny zapis pliku
Command injection w LocalAI — pełne przejęcie systemu przez parametr backend
Command injection w mudler/LocalAI — endpoint transkrypcji audio
mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the loc...
mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality...