CVE-2024-9597: Path Traversal in lollms

The primary impact of CVE-2024-9597 is the potential for an attacker to gain complete control over the file system. By crafting a malicious HTTP request targeting the /wipe_database endpoint, an attacker can manipulate the key parameter to specify arbitrary file paths. This allows them to delete any directory accessible to the lollms process, including critical system files, configuration files, and user data. Successful exploitation could lead to a complete system compromise, denial of service, and data loss. The blast radius extends to any data stored on the affected system, and depending on the lollms deployment, could impact other services relying on the same infrastructure.

1. Reserved2024-10-07
2. Published2025-03-20
3. EPSS updated2026-04-02

While a patched version of lollms is the recommended solution, immediate mitigation steps can be taken. First, restrict access to the /wipedatabase endpoint using a web application firewall (WAF) or proxy server. Implement strict access control lists (ACLs) to limit which users or IP addresses can access the endpoint. Secondly, implement robust input validation on the key parameter, ensuring it only accepts expected values and does not allow path traversal characters (e.g., ../). Monitor system logs for suspicious file deletion attempts, particularly targeting sensitive directories. Consider temporarily disabling the /wipedatabase endpoint if upgrading is not immediately feasible. After applying mitigations, verify their effectiveness by attempting to access the endpoint with a crafted request containing path traversal sequences.