CVE-2024-4315: LFI in lollms ≤9.8

The impact of CVE-2024-4315 is significant, particularly on Windows systems. An attacker can exploit this LFI vulnerability to read sensitive configuration files, source code, or even system binaries. The ability to delete files could lead to denial-of-service conditions or further compromise the system. The vulnerability's exploitation path through personalities and /del_preset suggests a relatively straightforward attack vector, potentially accessible to less sophisticated attackers. Successful exploitation could grant an attacker complete control over the affected system, allowing for data exfiltration, privilege escalation, and persistent access.

1. Reserved2024-04-29
2. Published2024-06-12
3. Modified2025-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-4315 is to upgrade lollms to version 9.8 or later, which includes the necessary path sanitization fixes. If an immediate upgrade is not feasible, consider implementing stricter file access controls and limiting the permissions of the lollms user account. Monitor the personalities and /del_preset endpoints for suspicious activity. While a WAF might offer some protection, it's unlikely to be effective against this type of LFI vulnerability without specific rules tailored to the application's logic. After upgrading, verify the fix by attempting to access files outside the intended directories via the vulnerable endpoints to confirm that directory traversal is prevented.