CVE-2024-4320

A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.

• CWE-29
• CWE-22

• https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279bExploit, Third Party Advisory
• https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279bExploit, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4319The Advanced Contact form 7 DB plugin for WordPress is vulne…5.3
• CVE-2024-43190IBM Engineering Requirements Management DOORS 9.7.2.9, under…5.9
• CVE-2024-43191IBM ManageIQ could allow a remote authenticated attacker to …8.8
• CVE-2024-43192IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerab…8.8
• CVE-2024-43196IBM OpenPages with Watson 8.3 and 9.0  application could al…4.3
• CVE-2024-43199Nagios NDOUtils before 2.1.4 allows privilege escalation fro…7.8
• CVE-2024-43201The Planet Fitness Workouts iOS and Android mobile apps fail…5.9
• CVE-2024-43202Exposure of Remote Code Execution in Apache Dolphinscheduler…9.8
• CVE-2024-43204SSRF in Apache HTTP Server with mod_proxy loaded allows an a…7.5
• CVE-2024-43207Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2024-43208Missing Authorization vulnerability in Matt Miller Send Emai…4.3
• CVE-2024-43209Missing Authorization vulnerability in Bitly allows Accessin…6.5