CVE-2024-6985

PyPI/lollms CVE-2024-6985: medium 4.4

Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-6h64-g7cj-hj56
• https://nvd.nist.gov/vuln/detail/CVE-2024-6985
• https://github.com/parisneo/lollms/commit/28ee567a9a120967215ff19b96ab7515ce469620
• https://github.com/ParisNeo/lollms
• https://huntr.com/bounties/79c11579-47d8-4e68-8466-b47c3bf5ef6a

CVE-2024-6985 · published 2024-10-11T18:32:50Z · modified 2024-11-15T20:57:13.953338Z · JSON

PyPI/lollms CVE-2024-6985: medium 4.4

A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the vi

Action: Upgrade lollms to 5.9.0 or later.

pip install lollms==5.9.0

Affected

Fixed versions

Sources

• osv: PYSEC-2024-122
• https://huntr.com/bounties/79c11579-47d8-4e68-8466-b47c3bf5ef6a
• https://github.com/parisneo/lollms/commit/28ee567a9a120967215ff19b96ab7515ce469620
• https://github.com/advisories/GHSA-6h64-g7cj-hj56

CVE-2024-6985 · published 2024-10-11T16:15:00Z · modified 2026-06-10T17:02:21.019676047Z · JSON