CVE-2024-4881 is a path traversal vulnerability in the parisneo/lollms application, specifically affecting version 9.4.0 and potentially earlier versions, though fixed in version 5.9.0. This flaw allows attackers to read arbitrary files on Windows systems due to improper validation of file paths containing backslashes, particularly via the /user_infos endpoint. Rated with a CVSS score of 7.5 (HIGH), the vulnerability has a network attack vector and low attack complexity, requiring no user interaction. Successful exploitation could lead to unauthorized access to sensitive information like configuration and database files, posing a significant risk of further system compromise. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. It is not listed in the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.9.0CPE matchmatch criteria | cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.