https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:51:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-1884 EUVD-2026-1884 https://cve.radiocsirt.org/vuln/euvd-2026-1884 https://cve.radiocsirt.org/vuln/fkie_cve-2024-2358 <p>A path traversal vulnerability in the &#39;/apply_settings&#39; endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the &#39;extensions&#39; parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (&#39;../../../&#39;), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious &#39;__init__.py&#39; file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.</p> <p>A path traversal vulnerability in the &#39;/apply_settings&#39; endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the &#39;extensions&#39; parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (&#39;../../../&#39;), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious &#39;__init__.py&#39; file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-2358 https://cve.radiocsirt.org/vuln/ghsa-m7qg-v9rw-76m9 <p>A path traversal vulnerability in the &#39;/apply_settings&#39; endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the &#39;extensions&#39; parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (&#39;../../../&#39;), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious &#39;__init__.py&#39; file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.</p> <p>A path traversal vulnerability in the &#39;/apply_settings&#39; endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the &#39;extensions&#39; parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (&#39;../../../&#39;), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious &#39;__init__.py&#39; file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.</p> https://cve.radiocsirt.org/vuln/ghsa-m7qg-v9rw-76m9 https://cve.radiocsirt.org/vuln/gsd-2024-2358 gsd-2024-2358 https://cve.radiocsirt.org/vuln/gsd-2024-2358