CVE-2024-2366

A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/lollms/server/endpoints/lollms_binding_infos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing an attacker to exploit path traversal to navigate to arbitrary directories. By manipulating the binding_path to point to a controlled directory and uploading a malicious __init__.py file, an attacker can execute arbitrary code on the server.

• CWE-77

• https://huntr.com/bounties/63266c77-408b-45ff-962c-8163db50a864Exploit, Issue Tracking, Patch, Third Party Advisory
• https://huntr.com/bounties/63266c77-408b-45ff-962c-8163db50a864Exploit, Issue Tracking, Patch, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23654discourse-ai is the AI plugin for the open-source discussion…7.2
• CVE-2024-23655Tuta is an encrypted email service. Starting in version 3.11…5.3
• CVE-2024-23656Dex is an identity service that uses OpenID Connect to drive…7.5
• CVE-2024-23657Nuxt is a free and open-source framework to create full-stac…8.8
• CVE-2024-23658In camera driver, there is a possible use after free due to …4.4
• CVE-2024-23659SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the…6.1
• CVE-2024-23660The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbb…7.5
• CVE-2024-23662An exposure of sensitive information to an unauthorized acto…7.5
• CVE-2024-23663An improper access control in Fortinet FortiExtender 4.1.1 -…8.8
• CVE-2024-23664A URL redirection to untrusted site ('open redirect') in For…6.1
• CVE-2024-23665Multiple improper authorization vulnerabilities [CWE-285] in…8.8
• CVE-2024-23666A client-side enforcement of server-side security in Fortine…8.8