Path traversal vulnerability in lollms-webui app installer
A path traversal vulnerability was identified in lollms-webui's app installation endpoints that failed to properly sanitize user-supplied file path parameters. The vulnerability was patched by adding path sanitization to prevent directory traversal attacks.
What happened
The lollms-webui application contained a path traversal vulnerability in its app installer endpoints. The vulnerability existed in the /install/{app_name}, /uninstall/{app_name}, and /lollms_assets/{asset_type}/{file_name} routes, which did not properly sanitize user-supplied path parameters.
A fix was implemented by adding sanitize_path() function calls to sanitize the app_name, asset_type, and file_name parameters before using them in file system operations.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.