A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal error.
The `upload_app` function does not validate or filter the value of the `filename` parameter passed by the user. An attacker can construct a specially crafted request containing path traversal sequences (e.g., `../../`), which will enable escaping beyond the intended application directory. As a result, it is possible to specify any location in the file system and delete the selected file or directory.
An attacker without any authentication can permanently delete any file or directory on the server, which may lead to data loss, system disruption, or complete unavailability.
The application should be updated to a version containing the patch available in commit dcc078cbe20d2a9640b0942a622134b0e3fa6e48 in the manufacturer's GitHub repository. It is also recommended to restrict network access to the lollms-webui instance only to trusted users.
parisneo/lollms-webui V12 (Strawberry)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HLollms Web Ui
APPLollms12
Related vulnerabilities
SSRF i brak uwierzytelnienia w lollms-webui — dostęp do wewnętrznych zasobów
Path traversal w API install/uninstall lollms-webui V12 (Strawberry)
Path Traversal i DoS w endpoint /select_database aplikacji lollms-webui
Command Injection w lollms-webui — obejście zabezpieczeń i RCE
Path Traversal prowadzący do RCE w parisneo/lollms-webui