https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:50:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-2541 EUVD-2026-2541 https://cve.radiocsirt.org/vuln/euvd-2026-2541 https://cve.radiocsirt.org/vuln/fkie_cve-2024-4320 <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-4320 https://cve.radiocsirt.org/vuln/ghsa-qfjf-662j-2xxg <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> https://cve.radiocsirt.org/vuln/ghsa-qfjf-662j-2xxg