LoLLMS anfällig für Verletzung des erwarteten Verhaltens

The path traversal vulnerability in lollms allows an attacker to bypass intended directory restrictions and access or modify files outside of the intended application directory. By manipulating the discussiondbname parameter, an attacker could potentially overwrite critical system files, execute arbitrary code, or gain persistent access to the system. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to write to arbitrary locations significantly expands the attack surface and increases the potential impact of a successful exploitation.

Users running lollms versions prior to 9.5.1, particularly those with lax file access permissions or who are running lollms in environments with limited security controls, are at significant risk. Shared hosting environments where multiple users share the same server and file system are also particularly vulnerable.

• python / server:

import os
import glob

# Check for suspicious files in lollms directories
restricted_dirs = ['/path/to/lollms/data', '/path/to/lollms/config']
for dir in restricted_dirs:
    for file in glob.glob(os.path.join(dir, '..*')): # Look for '..' in filenames
        print(f'Suspicious file found: {file}')

• linux / server:

# Check lollms process for unusual file access
lsof -p $(pgrep lollms) | grep '/../'

• generic web:

curl 'http://your-lollms-server/apply_settings?discussion_db_name=../../../../etc/passwd' -s | grep 'etc/passwd'

1. 2024-07-20Disclosure

   disclosure

1. Reserviert2024-06-23
2. Veröffentlicht2024-07-20
3. Geändert2025-10-15
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-6281 is to immediately upgrade lollms to version 9.5.1 or later. If upgrading is not immediately feasible, consider implementing strict file system permissions to limit write access to the lollms application directory. Additionally, input validation and sanitization should be implemented to prevent the injection of malicious path components. Monitor system logs for unusual file access or modification attempts. After upgrade, confirm the fix by attempting to access a restricted directory via the applysettings function with a crafted discussiondb_name parameter.