CVE-2024-6394 | parisneo lollms-webui up to 9.7 Configuration File app.py serve_js path traversal

A vulnerability classified as problematic has been found in parisneo lollms-webui up to 9.7. Affected is the function serve_js of the file app.py of the component Configuration File Handler. The manipulation leads to path traversal: ‘..filename’.

This vulnerability is traded as CVE-2024-6394. It is possible to launch the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.