{"id":"CVE-2024-6971","aliases":["PYSEC-2026-1585"],"url":"https://o3.security/vulnerability/CVE-2024-6971","summary":"Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py","details":"A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitize_path`. This allows an attacker to perform vectorize operations on `.sqlite` files in any directory on the victim's computer, potentially installing multiple packages and causing a crash.","published":"2024-10-11T15:30:32Z","modified":"2026-07-07T17:56:27.944652787Z","cvss":{"score":3.4,"severity":"LOW","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"},"epss":{"score":0.00319,"percentile":0.24779,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"lollms","fixedVersion":null}],"fix":{"url":"https://github.com/ParisNeo/lollms/commit/aeace796d861e922133b769710019608a6363264","label":"ParisNeo/lollms@aeace79"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6971"},{"type":"WEB","url":"https://github.com/ParisNeo/lollms/commit/aeace796d861e922133b769710019608a6363264"},{"type":"PACKAGE","url":"https://github.com/ParisNeo/lollms"},{"type":"WEB","url":"https://huntr.com/bounties/fbfe7cd0-99fb-4305-bd07-8b573364109e"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-07T17:56:27.944652787Z"}}