CVE-2024-6971

LOW Year: 2024
CVSS v3 Score
3.4
Low
Weakness Type
CWE-22
View all →

Vulnerability Description

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.

Related Vulnerabilities

CVE-2016-10538

LOW
CVSS:3.5(Low)

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

CWE-222016

CVE-2017-18196

LOW
CVSS:3.3(Low)

Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restricti...

CWE-222017

CVE-2018-0660

LOW
CVSS:3.3(Low)

Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.

CWE-222018

CVE-2020-15239

LOW
CVSS:3.5(Low)

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This c...

CWE-222020

CVE-2020-15703

LOW
CVSS:3.3(Low)

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in...

CWE-222020

CVE-2020-16116

LOW
CVSS:3.3(Low)

In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.

CWE-222020