CVE-2024-4267

A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' function. An attacker can exploit this vulnerability by crafting a malicious file path that, when processed by the 'open_file' function, executes arbitrary system commands or reads sensitive file content. This issue is present in the code where subprocess.Popen is used unsafely to open files based on user-supplied paths without adequate validation, leading to potential command injection.

• CWE-77

• https://huntr.com/bounties/5a127724-cc13-4ea6-b81f-41546a7fff81Exploit, Third Party Advisory
• https://huntr.com/bounties/5a127724-cc13-4ea6-b81f-41546a7fff81Exploit, Third Party Advisory

Published

May 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42651NanoMQ v0.17.9 was discovered to contain a heap use-after-fr…7.5
• CVE-2024-42655An access control issue in NanoMQ v0.21.10 allows attackers …8.8
• CVE-2024-42657An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.…7.5
• CVE-2024-42658An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.…9.8
• CVE-2024-4266The MetForm – Contact Form, Survey, Quiz, & Custom Form Buil…7.5
• CVE-2024-42662An issue in apollocongif apollo v.2.2.0 allows a remote atta…7.5
• CVE-2024-42671A Host Header Poisoning Open Redirect issue in slabiak Appoi…6.1
• CVE-2024-42675Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-42676File Upload vulnerability in Huizhi enterprise resource mana…8.8
• CVE-2024-42677An issue in Huizhi enterprise resource management system v.1…5.5
• CVE-2024-42678Cross Site Scripting vulnerability in Super easy enterprise …6.1
• CVE-2024-42679SQL Injection vulnerability in Super easy enterprise managem…7.8