https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:31:12 +0000 https://cve.radiocsirt.org/vuln/cve-2024-4320 <p><strong>Affected:</strong> parisneo/lollms-webui, parisneo lollms</p> <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> <p><strong>Affected:</strong> parisneo/lollms-webui, parisneo lollms</p> <p>A remote code execution (RCE) vulnerability exists in the &#39;/install_extension&#39; endpoint of the parisneo/lollms-webui application, specifically within the `@router.post(&#34;/install_extension&#34;)` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.</p> https://cve.radiocsirt.org/vuln/cve-2024-4320