CVE-2024-7058

MEDIUM Year: 2024
CVSS v3 Score
4.4
Medium
Weakness Type
CWE-23
View all →

Vulnerability Description

A vulnerability in the sanitize_path function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personality_folder on the victim's computer.

Related Vulnerabilities

CVE-2024-6985

MEDIUM
CVSS:4.4(Medium)

A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the vi...

CWE-232024

CVE-2020-5284

MEDIUM
CVSS:4.3(Medium)

Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the ...

CWE-232020

CVE-2022-20862

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could al...

CWE-232022

CVE-2022-22245

MEDIUM
CVSS:4.3(Medium)

A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Ju...

CWE-232022

CVE-2022-30299

MEDIUM
CVSS:4.3(Medium)

A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authentica...

CWE-232022

CVE-2023-1043

MEDIUM
CVSS:4.3(Medium)

A vulnerability was found in MuYuCMS 2.2. It has been classified as problematic. Affected is an unknown function of the file /editor/index.php. The manipulation of the argument dir_path leads to relat...

CWE-232023