CVE-2024-3322: Critical Path Traversal in lollms-webui

CVE-2024-3322 is a critical severity (CVSS 9.8) path traversal in the codeguard personality of parisneo lollms-webui, affecting versions up to 9.5. It allows arbitrary file read and overwrite through an unsanitized folder path. The record does not give a fixed version, so check the project's release notes and update.

What's affected

The record lists lollms-webui, also called lollms web ui, in versions up to 9.5. The flaw sits in the native personality named cyber_security/codeguard, in the process_folder function of scripts/processor.py inside the personalities zoo. The function does not limit the user supplied code_folder_path to a permitted directory.

The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no account and no user interaction, with high impact on confidentiality, integrity and availability. That combination is what produces 9.8.

The references are a GitHub commit in the lollms-webui repository and a huntr bounty report. I could not load either page in this review, so I am working from the record. The record does not name a fixed release. The commit is the place to confirm which version contains the change. The record does not mark this as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.

How to check if you're exposed

1. Find where lollms-webui runs. It is often installed on a developer laptop or a GPU server for local AI work.
2. Check the installed version. If you installed with pip, run pip show lollms-webui and read the Version line. If you cloned the repository, run git log -1 and compare it with the fixing commit linked in the sources.
3. Check whether the web interface is bound to anything other than localhost. A listener on all interfaces makes the flaw reachable from the network.
4. Check whether the codeguard personality is installed in the personalities zoo folder.
5. Look at web access logs for requests that include parent directory markers or absolute paths in a folder path value.

Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can list the packages in a project and flag known issues in them, which helps with the rest of an AI tooling stack.

What to do now

1. Update lollms-webui to a release that contains the fix commit. Confirm the version against the project release notes, since the record does not state it.
2. Until you update, bind the interface to localhost only, or put it behind a VPN or an authenticating reverse proxy.
3. Remove or disable the codeguard personality if you do not use it.
4. Run the service as a low privilege user with write access limited to its own data folders, so an overwrite cannot touch system files.
5. Review the host for unexpected changes to files outside the application folders, and rotate any keys or tokens stored in files the service account could read.

Why it matters

Path traversal is a simple mistake with a large effect. The code takes a folder path from the request and uses it as is. A value that climbs out of the intended directory, or that names an absolute location, makes the program read or write wherever its operating system account is allowed to. Here the function both reads and overwrites, so the impact is not limited to disclosure.

AI tooling is often run casually. A local web UI started for a test tends to stay up, sometimes on a shared network, and it usually runs with the full rights of the person who started it. That is why a flaw rated 9.8 in a local AI tool deserves the same handling as one in a production service.

Quick check

Sources

• NVD record for CVE-2024-3322
• Fix commit in parisneo/lollms-webui (referenced by the record)
• huntr bounty report (referenced by the record)

Last reviewed: 19 October 2026.