CVE-2024-9920
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 20, 2025
Updated: Apr 3, 2025
CWE ID 434
Summary
CVE-2024-9920 is a vulnerability affecting version 12 of the parisneo/lollms-webui package. The 'Send file to AL' functionality inadvertently allows the upload of potentially harmful file types, such as .py, .sh, and .bat, due to insufficient validation. An attacker can capitalize on this by submitting malicious files and utilizing the '/open_file' API to execute them. The root cause stems from the reliance on 'subprocess.Popen' for file opening without adequate checks, thereby posing a risk of remote code execution.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.