CVE-2024-3429

CVE-2024-3429 is a critical path traversal vulnerability affecting the parisneo/lollms application, specifically in versions prior to 9.6. This flaw, residing in the sanitize_path_from_endpoint and sanitize_path functions, allows attackers to bypass security measures on Windows systems. With a CVSS score of 9.8 (Critical), it enables unauthenticated remote attackers to achieve arbitrary file reading, leading to unauthorized access to sensitive information, potential data compromise, and even denial of service. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of concern.