CVE-2024-6281: Parisneo Lollms

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Affected products

• Parisneo Lollms: before 9.5.1 (fixed in 9.5.1)
• Parisneo Parisneo/lollms: before 9.5.1 (fixed in 9.5.1)

Published 2024-07-20. Last modified 2026-06-17.