CVE-2024-2178 Overview
CVE-2024-2178 is a path traversal vulnerability in parisneo/lollms-webui, an open-source web interface for large language models. The flaw resides in the copy_to_custom_personas endpoint defined in lollms_personalities_infos.py. Attackers can manipulate the category and name parameters during the Copy to custom personas folder for editing operation to escape the intended directory. By injecting ../ sequences into these parameters, an unauthenticated remote attacker can traverse the file system and read arbitrary files. The issue is tracked under [CWE-29: Path Traversal: '..\filename'].
Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host running lollms-webui, exposing configuration data, credentials, and application source code.
Affected Products
- parisneo lollms-webui (Lollms Web UI)
- Deployments exposing the copy_to_custom_personas endpoint
- Instances running the vulnerable lollms_personalities_infos.py handler
Discovery Timeline
- 2024-06-02 - CVE-2024-2178 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2178
Vulnerability Analysis
The copy_to_custom_personas endpoint accepts user-controlled category and name parameters and uses them to construct a file system path. The handler does not normalize or validate these values before joining them to a base directory. Supplying ../ sequences allows the resulting path to resolve outside the intended personas folder. The server then reads and returns file content from the traversed location. Because the endpoint does not require authentication, any network-reachable attacker can invoke it. Successful exploitation yields unauthorized disclosure of files readable by the lollms-webui process.
Root Cause
The root cause is missing input sanitization on path components used in a copy operation. The code trusts the category and name values as safe directory and file identifiers. It does not reject relative traversal tokens, does not canonicalize the final path, and does not enforce a base-directory containment check. This maps to [CWE-29], which covers improper limitation of a pathname to a restricted directory.
Attack Vector
Exploitation requires only network access to the lollms-webui HTTP interface. An attacker issues a request to the copy_to_custom_personas endpoint with crafted category and name values containing ../ sequences. The server resolves the path outside the personas directory and copies or exposes the target file. Typical targets include /etc/passwd, application configuration files, private keys, and Python source containing secrets. No user interaction and no prior authentication are required.
A verified proof-of-concept is not publicly available. Refer to the Huntr Bounty Listing for technical details reported by the researcher.
Detection Methods for CVE-2024-2178
Indicators of Compromise
- HTTP requests to the copy_to_custom_personas endpoint containing ../, ..%2f, or encoded traversal sequences in category or name parameters.
- Unexpected file access by the lollms-webui process to paths outside the personas directory.
- Web server or application logs showing 200 responses to malformed persona copy requests originating from external IP addresses.
Detection Strategies
- Inspect application and reverse-proxy logs for traversal patterns targeting /copy_to_custom_personas or related persona management routes.
- Deploy web application firewall rules that flag ../, ..\\, and URL-encoded variants in query strings and POST bodies.
- Correlate outbound file reads by the Python runtime against an allowlist of expected persona directory paths.
Monitoring Recommendations
- Alert on any successful HTTP response from persona endpoints where request parameters contain traversal metacharacters.
- Monitor for reads of sensitive files such as /etc/passwd, .env, and SSH key material by the lollms-webui service account.
- Track anomalous spikes in requests to persona management endpoints from single source addresses.
How to Mitigate CVE-2024-2178
Immediate Actions Required
- Restrict network access to lollms-webui using firewall rules or reverse-proxy authentication until a patched version is deployed.
- Audit the persona directory and application logs for prior traversal attempts against the copy_to_custom_personas endpoint.
- Rotate any credentials, tokens, or keys that may have been readable by the lollms-webui process.
Patch Information
Consult the Huntr Bounty Listing and the upstream parisneo/lollms-webui repository for the fixed release. Upgrade to the latest version that includes input validation on the category and name parameters of the persona copy handler.
Workarounds
- Place lollms-webui behind an authenticating reverse proxy and block direct external access to the API.
- Add a WAF rule that rejects requests to persona endpoints containing ../, ..\\, %2e%2e, or other traversal encodings.
- Run the lollms-webui process under a low-privilege user with read access limited to its own application directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
