https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 06:22:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-2529 EUVD-2026-2529 https://cve.radiocsirt.org/vuln/euvd-2026-2529 https://cve.radiocsirt.org/vuln/fkie_cve-2024-4330 <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-4330 https://cve.radiocsirt.org/vuln/ghsa-9p73-x86v-jw57 <p><strong>Affected:</strong> PyPI: lollms</p> <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> https://cve.radiocsirt.org/vuln/ghsa-9p73-x86v-jw57 https://cve.radiocsirt.org/vuln/pysec-2026-1589 <p><strong>Affected:</strong> PyPI: lollms</p> <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the &#39;list_personalities&#39; endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the &#39;category&#39; parameter to access arbitrary directories. The vulnerability is present in the code located at the &#39;endpoints/lollms_advanced.py&#39; file.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1589