Home » Database

AVID-2026-R1362

Description

Path Traversal and OS Command Injection in parisneo/lollms-webui (CVE-2024-10019)

Details

A vulnerability in the start_app_server function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the app_name parameter, enabling an attacker to upload a malicious server.py file and execute arbitrary code by exploiting the path traversal vulnerability.

Reason for inclusion in AVID: The CVE targets parisneo/lollms-webui, a software component used to deploy AI models; it enables path traversal and OS command injection leading to arbitrary code execution (RCE) by uploading server.py. This is a software supply chain vulnerability affecting AI deployment/serving tooling, not hardware. The description, CWE-78, CVSS data, and references provide clear evidence; therefore it should be kept for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: parisneo
  • Deployer: parisneo
  • Artifact Details:
TypeName
Systemparisneo/lollms-webui

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Base Score6.3
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges Required🔴 High
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-78CWE-78 Improper Neutralization of Special Elements used in an OS Command

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry