CVE-2024-6139 — Path Traversal in parisneo/lollms
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary loc…
Published: 2024-06-27 · CVSS: 7.3 · CVSS 3.0
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7