CVE-2024-2360 is a critical severity (9.8) flaw in Lollms Web UI (parisneo/lollms-webui): path traversal that can lead to remote code execution. The record names no fixed release. Keep the interface off any untrusted network and check the project for a newer version before use.
Weakness: CWE-29 (Path Traversal: ..\filename), CWE-22 (Path Traversal).
What's affected
- Affected: parisneo/lollms-webui, the latest version at disclosure. The CPE has no version, and the text says the issue affects the latest version at disclosure.
- Fixed: none named in the record. Check the project's releases.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means network reachable, no privileges and no user interaction.
The record says the Database path and PDF LaTeX path settings, handled as discussion_db_name and pdf_latex_path, do not properly validate file paths. It also says the issue can lead to further file exposure.
How to check if you're exposed
Lollms Web UI is a self-hosted Python application. Check your copy.
- Find your installed version from the interface or the repository tag you cloned.
- Confirm which network interfaces the process listens on, for example with
ss -ltnpon Linux ornetstat -anoon Windows, and look for the web UI port bound to anything other than localhost. - Check whether a reverse proxy or port forward makes it reachable from other networks.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Bind the interface to localhost, or place it behind authentication and a VPN. Do not publish it to the internet.
- Check the lollms-webui project for a release that addresses this CVE and read its notes. The record names none.
- Run the application as a low-privilege account in a container or VM so a code execution or file deletion bug has limited reach.
- Back up the data you care about, since the record describes file deletion or code execution as possible outcomes.
- Keep the version and exposure in your inventory so you can recheck when a fix ships.
Why it matters
The record classes this as CWE-29 (Path Traversal: ..\filename), CWE-22 (Path Traversal). In plain terms, the application trusts input that controls a file path or a setting that controls access, and an unauthenticated visitor can supply it. These tools are often installed on a workstation for convenience, then exposed on a network without anyone deciding to.
NVD scored it 9.8 (Critical). The KEV flag is false, and the huntr report cited in the record does not claim exploitation in the wild.
Quick check
Is there a fixed version for CVE-2024-2360?
The record names none. Check the lollms-webui releases and the huntr report before assuming a fix.
Does this affect only Windows?
The record does not limit it to Windows.
Sources
- CVE-2024-2360 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2360, as held in the batch record
- huntr report
Last reviewed: 19 October 2026.
