CVE-2024-4320

The record

A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.

Affected packages

Related vulnerabilities

• CVE-2026-66152 A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor… CWE-29
• CVE-2026-10732 All versions of the package decompress are vulnerable to Arbitrary File Write via Archive… CWE-29
• CVE-2026-24217 NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path… CWE-29
• CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and… CWE-29
• CVE-2025-15036 A path traversal vulnerability exists in the `extract_archive_to_dir` function within the… CWE-29
• CVE-2026-30828 Wallos is an open-source, self-hostable personal subscription tracker. CWE-29
• CVE-2025-66608 A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. CWE-29
• CVE-2024-2356 A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint… CWE-29