Medium severity4.4NVD Advisory· Published Oct 11, 2024· Updated Jun 17, 2026
CVE-2024-6985
CVE-2024-6985
Description
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
lollmsPyPI | <= 9.5.1 | — |
Affected products
3- parisneo/parisneo/lollmsv5Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/parisneo/lollms/commit/28ee567a9a120967215ff19b96ab7515ce469620nvdPatchWEB
- huntr.com/bounties/79c11579-47d8-4e68-8466-b47c3bf5ef6anvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-6h64-g7cj-hj56ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-6985ghsaADVISORY
News mentions
0No linked articles in our index yet.