Medium severity6.3NVD Advisory· Published Jun 24, 2024· Updated Jun 17, 2026
CVE-2024-4499
CVE-2024-4499
Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- parisneo/parisneo/lollmsv5Range: unspecified
Patches
Vulnerability mechanics
References
1- huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65anvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.