CVE-2024-2362 is a critical severity (9.1) flaw in Lollms Web UI (parisneo/lollms-webui): arbitrary file deletion through path traversal on Windows. The record names no fixed release. Keep the interface off any untrusted network and check the project for a newer version before use.
Weakness: CWE-36 (Absolute Path Traversal), CWE-22 (Path Traversal).
What's affected
- Affected: parisneo/lollms-webui, 9.3 on Windows. The CPE lists version 9.3.
- Fixed: none named in the record. Check the project's releases.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which means network reachable, no privileges and no user interaction.
The record says the del_preset endpoint does not block absolute paths or directory traversal sequences, so files outside the intended directory can be deleted. It describes the root cause as improper validation of paths between Windows and Linux.
How to check if you're exposed
Lollms Web UI is a self-hosted Python application. Check your copy.
- Find your installed version from the interface or the repository tag you cloned.
- Confirm which network interfaces the process listens on, for example with
ss -ltnpon Linux ornetstat -anoon Windows, and look for the web UI port bound to anything other than localhost. - Check whether a reverse proxy or port forward makes it reachable from other networks.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Bind the interface to localhost, or place it behind authentication and a VPN. Do not publish it to the internet.
- Check the lollms-webui project for a release that addresses this CVE and read its notes. The record names none.
- Run the application as a low-privilege account in a container or VM so a code execution or file deletion bug has limited reach.
- Back up the data you care about, since the record describes file deletion or code execution as possible outcomes.
- Keep the version and exposure in your inventory so you can recheck when a fix ships.
Why it matters
The record classes this as CWE-36 (Absolute Path Traversal), CWE-22 (Path Traversal). In plain terms, the application trusts input that controls a file path or a setting that controls access, and an unauthenticated visitor can supply it. These tools are often installed on a workstation for convenience, then exposed on a network without anyone deciding to.
NVD scored it 9.1 (Critical). The KEV flag is false, and the huntr report cited in the record does not claim exploitation in the wild.
Quick check
Is there a fixed version for CVE-2024-2362?
The record names none. Check the lollms-webui releases and the huntr report before assuming a fix.
Does this affect only Windows?
The record describes this one as a Windows issue caused by path handling differences between Windows and Linux.
Sources
- CVE-2024-2362 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2362, as held in the batch record
- huntr report
Last reviewed: 19 October 2026.
