CVE-2024-4320
Path Traversal in Lollms Web Ui
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-4320 is a critical-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Lollms Lollms Web Ui. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Supply Chain and Deployment risk domain; MITRE ATLAS techniques in scope: Hardware (AML.T0010.000), Adversarial AI Attack Implementations (AML.T0016.000), Infer Training Data Membership (AML.T0024.000).
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A remote code execution vulnerability, tracked as CVE-2024-4320, affects the latest version of the parisneo/lollms-webui application. It resides in the /install_extension endpoint and specifically in the route handler that invokes ExtensionBuilder().build_extension(). Improper validation of the name parameter permits local file inclusion, enabling an attacker to force the server to load and execute a __init__.py file from an arbitrary path such as a discussion upload directory. The flaw is assigned CWE-29 and CWE-22 and carries a CVSS 3.1 score of 9.8.
An unauthenticated attacker can exploit the issue over the network by supplying a crafted name value in a POST request to the endpoint. Successful exploitation results in arbitrary code execution on the server without user interaction, particularly when the application is reachable externally or running in headless mode.
The EPSS score for the vulnerability stands at 0.6623 with an identical peak value, indicating sustained but not sharply increasing exploitation interest after disclosure. No mitigation guidance or patch details appear in the supplied references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43963
Vulnerability Data
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local…
more
file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- parisneo/lollms-webui is an open-source web UI platform for running and managing large language models (LLMs) locally, qualifying it as an AI-related platform under 'Other Platforms'. The vulnerability is in its extension installation endpoint, confirmed AI-related via AI/ML bug bounty advisory.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability via LFI in the public-facing '/install_extension' web endpoint of parisneo/lollms-webui, directly enabling exploitation of a public-facing application.
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of the 'name' parameter in the /install_extension handler to block crafted LFI values that load arbitrary __init__.py files.
Enforces access-control decisions on the unauthenticated /install_extension endpoint so only authorized subjects may invoke ExtensionBuilder.build_extension().
Requires integrity verification of loaded extension code, enabling detection of unauthorized __init__.py files executed from untrusted paths such as the discussion upload directory.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover path-traversal flaws but does not itself prevent them in production code.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements can mandate input validation and path canonicalization to block traversal sequences.
Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.
Secure coding standards directly require neutralizing path traversal sequences such as '\..\filename'.
Information access restriction limits which files an application may read or write.