A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.
History

Wed, 15 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-440

Wed, 15 Oct 2025 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22

cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-07-20T03:19:25.663Z

Updated: 2025-10-15T12:50:33.120Z

Reserved: 2024-06-23T21:31:29.887Z

Link: CVE-2024-6281

cve-icon Vulnrichment

Updated: 2024-08-01T21:33:05.497Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-07-20T04:15:05.260

Modified: 2025-10-15T13:15:49.780

Link: CVE-2024-6281

cve-icon Redhat

No data.