CVE-2024-8898 — Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to cr…
Published: 2025-03-20 · CVSS: 6.7 · CVSS 3.0
A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of user-supplied input, which can be exploited to traverse directories outside the intended path.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7