| Package | Affected versions | Patched versions |
|---|---|---|
| lollms | ≤ 9.5.1 | |
| lollms-webui | = 9.8 |
A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollms_file_system.py file. The functions add_rag_database, toggle_mount_rag_database, and vectorize_folder do not implement security measures such as sanitize_path_from_endpoint or sanitize_path. This allows an attacker to perform vectorize operations on .sqlite files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free