CVE-2024-2288 is a high severity (8.3) cross-site request forgery flaw in the profile picture upload of Lollms Web UI (parisneo/lollms-webui). The record says version 9.3 resolves it. Upgrade, and do not leave the interface open to untrusted networks or browsers. NVD published it on 2024-06-06.
Weakness: CWE-352 (Cross-Site Request Forgery).
What's affected
- Affected: parisneo/lollms-webui, versions up to 7.3.0 according to the record text.
- Fixed: the record says the issue is resolved in version 9.3.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H, so network reachable, no privileges, and it needs a user interaction such as visiting a hostile page.
Version note: other Lollms records in this series list 9.3 as an affected version, and the CPE for this CVE does not give a version range. Confirm the fixed version in the project's GitHub history before relying on the record's wording.
How to check if you're exposed
Lollms Web UI is a Python application, normally installed from its GitHub repository or pip. Check what you run.
- Look at the version shown in the interface or in the repository tag you cloned.
- If you installed with pip, run
pip show lollmsto see the package version. This reports the lollms package and may differ from the web UI release, so also check the repository tag. - Check whether the interface is reachable from other machines or from a browser that also visits untrusted sites.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Update lollms-webui to the current release and read the project's release notes for the CSRF fix.
- Keep the interface bound to localhost or a private network, and do not run it in a browser profile that also browses untrusted sites.
- Review the profile picture storage folder for unexpected files and clean it up.
- Re-test after upgrade with a build you control, and record the version in your inventory.
Why it matters
CSRF abuses the fact that a browser attaches your session to requests made by any page you visit. If the upload endpoint does not check that the request really came from the application, a hostile page can submit one on your behalf. The record says this can lead to a stored cross-site scripting issue and to filling the disk with files.
The weakness is CWE-352 (Cross-Site Request Forgery). The KEV flag is false. The record, via the huntr report, does not claim in the wild abuse.
Quick check
What is the fixed version?
The record says version 9.3. Other Lollms records list 9.3 as affected, so verify against the project's commit history and release notes.
Does this need a login?
The vector lists no privileges required, but a user must be tricked into a request, which is why CVSS marks user interaction as required.
Sources
- CVE-2024-2288 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2288, as held in the batch record
- Fix commit in parisneo/lollms-webui
- huntr report
Last reviewed: 19 October 2026.
