lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

HIGH 7.4CVE-2024-5824 · GHSA-m45c-v46h-c788 · PYSEC-2026-1592 · Published 27/06/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
lollms PyPI	`< 9.5.0`	`9.5.0`

Description

A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.

NVD description

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.

References

nvd.nist.gov/vuln/detail/CVE-2024-5824 · ADVISORY
parisneo/lollms commit eda3af5 · WEB
parisneo/lollms · PACKAGE
huntr.com/bounties/9ceb7cf9-a7cd-4699-b3f8-d0999d2b49fd · WEB
pypi.org/project/lollms · PACKAGE
GitHub Advisory GHSA-m45c-v46h-c788 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free