CVE-2024-3435

A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2	Patch
https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5	Exploit Third Party Advisory Issue Tracking Patch
https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2	Patch
https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5	Exploit Third Party Advisory Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*

History

09 Jul 2025, 14:33

Type	Values Removed	Values Added
References	~~() https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2 -~~	() https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2 - Patch
References	~~() https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5 -~~	() https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5 - Exploit, Third Party Advisory, Issue Tracking, Patch
First Time		Lollms lollms Web Ui Lollms
CPE		cpe:2.3:a:lollms:lollms_web_ui::::::::

Information

Published : 2024-05-16 09:15

Updated : 2025-07-09 14:33

NVD link : CVE-2024-3435

Mitre link : CVE-2024-3435

CVE.ORG link : CVE-2024-3435

JSON object : View

Products Affected

lollms

lollms_web_ui

CWE

CWE-29

Path Traversal: '\..\filename'

{"id": "CVE-2024-3435", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2024-05-16T09:15:14.290", "references": [{"url": "https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5", "tags": ["Exploit", "Third Party Advisory", "Issue Tracking", "Patch"], "source": "security@huntr.dev"}, {"url": "https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5", "tags": ["Exploit", "Third Party Advisory", "Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-29"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en el endpoint 'save_settings' de la aplicaci\u00f3n parisneo/lollms-webui, que afecta a las versiones hasta la \u00faltima versi\u00f3n anterior a la 9.5. La vulnerabilidad surge debido a una sanitizaci\u00f3n insuficiente del par\u00e1metro 'config' en la funci\u00f3n 'apply_settings', lo que permite a un atacante manipular la configuraci\u00f3n de la aplicaci\u00f3n enviando payloads JSON especialmente manipuladas. Esto podr\u00eda conducir a la ejecuci\u00f3n remota de c\u00f3digo (RCE) al pasar por alto los parches existentes manipulados para mitigar dichas vulnerabilidades."}], "lastModified": "2025-07-09T14:33:50.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7DA38B5-6496-47C5-88AF-17C4AF269B59", "versionEndExcluding": "9.5"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}