---
id: CVE-2024-5824
aliases:
  - GHSA-m45c-v46h-c788
  - PYSEC-2026-1592
title: >-
  lollms path traversal vulnerability allows overriding of config.yaml file,
  leading to RCE
summary: >-
  lollms path traversal vulnerability allows overriding of config.yaml file,
  leading to RCE
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: lollms
product: lollms
ecosystem: pip
affected:
  - lollms < 9.5.0
patched:
  - lollms 9.5.0
published: '2024-06-27'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m45c-v46h-c788'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-5824'
  - url: >-
      https://github.com/parisneo/lollms/commit/eda3af5f5c4ea9b2f3569f72f8d05989e29367fc
  - url: 'https://github.com/parisneo/lollms'
  - url: 'https://huntr.com/bounties/9ceb7cf9-a7cd-4699-b3f8-d0999d2b49fd'
tags:
  - osv
  - pip
epss: 0.00448
epssPercentile: 0.36212
ingestedAt: '2026-07-08T18:25:51.122Z'
---

## Overview

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.

## Affected packages

- `lollms < 9.5.0`

## Remediation

Upgrade to a patched release:

- `lollms 9.5.0`