We use cookies to improve your experience on our site.
AVID-2026-R1395
Description
Path Traversal Vulnerability in parisneo/lollms-webui (CVE-2024-1511)
Details
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Reason for inclusion in AVID: CVE-2024-1511 documents a path traversal vulnerability in parisneo/lollms-webui, enabling unauthenticated attackers to read, write, and potentially execute arbitrary files via the web UI. This is a software vulnerability in a component commonly used to host or serve AI models (AI deployment/UI stack). As such, it directly pertains to the software supply chain of general-purpose AI systems (model serving stacks, UI front-ends, and related tooling) rather than hardware/firmware. The CVE details (path traversal CWE-22, CVSSv3.0 9.8, network-based, no user interaction) provide clear security risk signals and references, supporting its relevance to AI software supply chains.
References
Affected or Relevant Artifacts
- Developer: parisneo
- Deployer: parisneo
- Artifact Details:
| Type | Name |
|---|---|
| System | parisneo/lollms-webui |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.0 |
| Vector String | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Base Score | 9.8 |
| Base Severity | 🔴 Critical |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | 🔴 High |
| Integrity Impact | 🔴 High |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-22 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2024-04-10
- Version: 0.3.3
- AVID Entry