CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.

• CWE-22

• https://huntr.com/bounties/fbfe7cd0-99fb-4305-bd07-8b573364109eExploit, Third Party Advisory

Published

Oct 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6965A vulnerability has been found in Tenda O3 1.0.0.10 and clas…8.8
• CVE-2024-6966A vulnerability was found in itsourcecode Online Blood Bank …9.8
• CVE-2024-6967A vulnerability was found in SourceCodester Employee and Vis…7.5
• CVE-2024-6968A vulnerability was found in SourceCodester Clinics Patient …7.5
• CVE-2024-6969A vulnerability was found in SourceCodester Clinics Patient …7.5
• CVE-2024-6970A vulnerability classified as critical has been found in its…9.8
• CVE-2024-6972In affected versions of Octopus Server under certain circums…6.5
• CVE-2024-6973Remote Code Execution in Cato Windows SDP client via crafted…8.8
• CVE-2024-6974Cato Networks Windows SDP Client Local Privilege Escalation …7.8
• CVE-2024-6975Cato Networks Windows SDP Client Local Privilege Escalation …8.8
• CVE-2024-6977A vulnerability in Cato Networks SDP Client on Windows allow…6.5
• CVE-2024-6978Cato Networks Windows SDP Client Local root certificates can…8.8