Vulnerability Database

296,489

Total vulnerabilities in the database

CVE-2024-10019

A vulnerability in the start_app_server function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the app_name parameter, enabling an attacker to upload a malicious server.py file and execute arbitrary code by exploiting the path traversal vulnerability.

  • Published: Mar 20, 2025
  • Updated: Jul 9, 2025
  • CVE: CVE-2024-10019
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.7
  • AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWEs:

Software From Fixed in
lollms / lollms_web_ui 12 12.x