Path Traversal in parisneo/lollms

The /wipe_database endpoint in lollms is vulnerable to Path Traversal due to insufficient validation of the key parameter. An attacker can craft a malicious HTTP request, manipulating this parameter to construct arbitrary file paths. This allows them to delete any directory accessible to the lollms process, potentially including critical system files, configuration data, or user data. The blast radius extends to the entire system, as the attacker gains the ability to erase any directory they can reach. This vulnerability is particularly concerning given the potential for complete system compromise through data deletion.

Organizations deploying lollms, particularly those running the latest version without proper input validation or access controls, are at significant risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a compromise of one user's lollms instance could lead to the compromise of the entire server.

• python / server:

import os
import requests

url = 'http://your-lollms-server/wipe_database?key=../../../../etc/passwd'

try:
    response = requests.get(url)
    if response.status_code == 200:
        print("Potential Path Traversal detected!")
    else:
        print("Request failed.")
except requests.exceptions.RequestException as e:
    print(f"Error: {e}")

• linux / server:

journalctl -u lollms -f | grep "wipe_database"

• generic web:

curl -I http://your-lollms-server/wipe_database?key=../../../../etc/passwd

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-10-07
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-9597 is to upgrade to a patched version of lollms as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. One approach is to restrict access to the /wipedatabase endpoint using a Web Application Firewall (WAF) or proxy server, blocking requests with suspicious characters in the key parameter. Additionally, carefully review and restrict the permissions of the user account running the lollms process to minimize the potential damage from a successful attack. Monitor system logs for unusual file deletion activity. After upgrading, confirm the vulnerability is resolved by attempting a controlled request to the /wipedatabase endpoint with a crafted path traversal payload and verifying that it is rejected.