| Package | Affected versions | Patched versions |
|---|---|---|
| lollms web ui | = 9.6 |
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free