CVE-2024-2548 is a high severity (CVSS 7.5) path traversal in the parisneo lollms-webui application on Windows. A file server endpoint validates paths in a way that lets a crafted request read arbitrary files. The record says version 9.5 addresses the issue, so upgrade to it or later.
What's affected
The parisneo lollms-webui application, running on Windows, per the record. The code is in lollms_binding_files_server.py and security.py under lollms_core. The record says the issue affects the latest version at the time of the report and was addressed in version 9.5. The check used Path(path).is_absolute(), which behaves differently for Windows and Linux style paths.
The NVD record scores it 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, published 2024-06-06. The weakness is classed as CWE-36 (absolute path traversal) and CWE-22 (path traversal).
The record says the issue was addressed in version 9.5. I could not load the huntr report. The linked GitHub commit I fetched is a short sync commit whose page does not state the cause. Confirm against the release notes for 9.5.
How to check if you're exposed
Check which version of LoLLMs Web UI you run. From the install folder:
git describe --tags
pip show lollms 2>/dev/null
The version number must be 9.5 or higher. Also note whether the host is Windows, since that is where the record places the problem.
What to do now
- Upgrade lollms-webui to 9.5 or a later release.
- Do not expose the web UI to the internet or to untrusted networks, and bind it to localhost where you can.
- Run the service under an account that cannot read secrets or user profiles.
- Rotate any API keys stored in files the service account could read.
- Review access logs for odd requests to the user information endpoint.
Why it matters
The weakness is path traversal. A file name or path from the request is joined to a base folder without being normalised and confined to that folder, so sequences that climb up directories can point the operation at files elsewhere on the host. Depending on the function that can mean reading, overwriting or deleting files outside the intended folder.
The fix is to resolve the final path and confirm it still sits under the intended base directory, reject absolute paths and parent directory segments, and give the service account only the file rights it needs.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Linux affected?
The record says the issue affects the Windows platform, because of how path checks treated Windows style paths. It does not say Linux is safe, so upgrade anyway.
Sources
Last reviewed: 19 October 2026.
