LOW 3.4
GHSA-7pgr-32fx-c6x9
Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
Details
A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / lollms
Introduced in:
0 No fixed version published yet for lollms (pip). Pin to a known-safe version or switch to an alternative.