CVE-2024-5824: Parisneo Lollms-Webui

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.

Affected products

• Parisneo Lollms-Webui: any version
• Parisneo Parisneo/lollms: affected versions not specified

Published 2024-06-27. Last modified 2026-06-17.