CVE-2024-2358

Name: CVE-2024-2358
Creator: NVD / NIST
Published: 2024-05-16T09:15:09.8+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.12%

Last modified Jun 17, 2026

CVE-2024-2358 is a vulnerability of currently unknown severity. A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. EPSS estimates a 1.12% chance of exploitation in the next 30 days.

Description

A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.

Metrics

EPSS Probability

1.12%

62.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-29

Affected Software

Vendor	Product	Versions
Lollms	Lollms Web Ui	< 9.5

References

https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22Exploit, Issue Tracking, Patch, Third Party Advisory
https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: May 16, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-2358?

How severe is CVE-2024-2358?

Severity scoring for CVE-2024-2358 is pending analysis. The EPSS model estimates a 1.12% probability of exploitation in the next 30 days.

How do I fix CVE-2024-2358?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-2358?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST