Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint
Date: 2024-10
Affected: pip/lollms
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-6985
CWE: CWE-23
CVSS: 4.4 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set. The issue arises due to improper sanitization of the personality_folder parameter, which can be exploited to traverse directories and access arbitrary files.


Mitigations:

Architectural layers (MAESTRO):