CVE-2024-4322
CVE-2024-4322 is a high-severity vulnerability in Lollms Lollms Web Ui with a CVSS 3.x base score of 7.5. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-29.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- EPSS exploit prediction: 31% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-43965
- Weakness: CWE-29
- Affected product: Lollms Lollms Web Ui
- Published:
- Last modified:
Description
A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.
Frequently asked questions
- What is CVE-2024-4322?
- A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.
- How severe is CVE-2024-4322?
- CVE-2024-4322 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2024-4322 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-4322?
- CVE-2024-4322 affects Lollms Lollms Web Ui. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-4322?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-4322 have an EU (EUVD) identifier?
- Yes. CVE-2024-4322 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-43965.
- When was CVE-2024-4322 published?
- CVE-2024-4322 was published on 2024-05-16 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*
More vulnerabilities in Lollms Lollms Web Ui
- CVE-2024-8898 — Critical (CVSS 9.8): A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version…
- CVE-2024-4320 — Critical (CVSS 9.8): A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui…
- CVE-2024-3322 — Critical (CVSS 9.8): A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the…
- CVE-2024-2624 — Critical (CVSS 9.8): A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically…
- CVE-2024-2360 — Critical (CVSS 9.8): parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to…
- CVE-2024-2359 — Critical (CVSS 9.8): A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and…
All CVEs affecting Lollms Lollms Web Ui →
Other CWE-29 vulnerabilities
- CVE-2025-15036 — Critical (CVSS 10.0): A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…
- CVE-2024-2083 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps…
- CVE-2024-6396 — Critical (CVSS 9.8): A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any…
- CVE-2024-5443 — Critical (CVSS 9.8): CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the…
- CVE-2024-2358 — Critical (CVSS 9.8): A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute…
- CVE-2023-6975 — Critical (CVSS 9.8): A malicious user could use this issue to get command execution on the vulnerable machine and get access to data &…