CVE-2024-2358

A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.

• CWE-29

• https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22Exploit, Issue Tracking, Patch, Third Party Advisory
• https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22Exploit, Issue Tracking, Patch, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23574HCL Aftermarket EPC is vulnerable to attack since It was fou…5.3
• CVE-2024-23575HCL Aftermarket EPC is vulnerable to attack since the applic…5.3
• CVE-2024-23576Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 cou…7.1
• CVE-2024-23577HCL Aftermarket EPC is vulnerable since the application does…4.3
• CVE-2024-23578HCL Aftermarket EPC is vulnerable to attack as the applicati…4.2
• CVE-2024-23579HCL DRYiCE Optibot Reset Station is impacted by insecure enc…6.5
• CVE-2024-23580HCL DRYiCE Optibot Reset Station is impacted by insecure enc…6.5
• CVE-2024-23581The HCL Traveler for Microsoft Outlook libraries are being f…7.8
• CVE-2024-23583An attacker could potentially intercept credentials via the …6.7
• CVE-2024-23584The NMAP Importer service​ may expose data store credentials…6.6
• CVE-2024-23586HCL Nomad is susceptible to an insufficient session expirati…7.5
• CVE-2024-23588HCL Nomad server on Domino fails to properly handle users co…6.5