Lollms Webui
Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms-webui:9.5:*:*:*:*:*:*:*
part: a version: 9.5 update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms Webui (b2a1cced-948c-5799-bcda-7edd409fa278) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:17:49.452778 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4267 |
vulnerable | 2026-06-08 06:50:17.393383 |
Remote Code Execution in parisneo/lollms-webui
HIGH (8.4)
A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' function. An attacker can exploit this vulnerability by crafting a malicious file path that, when processed by the 'open_file' function, executes arbitrary system commands or reads sensitive file content. This issue is present in the code where subprocess.Popen is used unsafely to open files based on user-supplied paths without adequate validation, leading to potential command injection.
Published: 2024-05-22T19:29:56.867Z
Updated: 2024-08-01T20:33:53.200Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.