SecuriTricks - CVE-2024-6139

Description

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.

Product(s) Impacted

Product	Versions
parisneo/lollms	v9.6

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-29

Path Traversal: '\..\filename'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

References

https://huntr.com/bounties/fd00f112-efd0-40a1-8227-d6733716e4c0

CVSS Score

7.3 / 10

CVSS Data - 3.0

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

View Vector String

Timeline

Published: June 27, 2024, 7:15 p.m.
Last Modified: June 27, 2024, 7:25 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

security@huntr.dev

CVE-2024-6139