CVE-2024-3429Critical· 9.8▾ MidnightLoLLMS Path Traversal vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 5.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
28%
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitize_path_from_endpoint and sanitize_path functions in lollms_core\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.5.0.
lollms < 9.5.0Upgrade to a patched release:
lollms 9.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-4078Critical· 9.8LoLLMS Command Injection vulnerability
CVE-2024-5824High· 7.4lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
CVE-2026-1114Critical· 9.8LoLLMs is vulnerable to Improper Access Control through weak secret key
CVE-2024-6281High· 7.3LoLLMS vulnerable to Expected Behavior Violation
CVE-2026-1117High· 8.2Lollms has an Improper Access Control vulnerability
CVE-2026-1116Medium· 6.1A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms pr…