CVE-2024-3429 is a critical severity path traversal flaw (CVSS 9.8) in parisneo lollms, in its path sanitizing functions, when it runs on Windows. The record says it affects the latest version prior to 9.6. Upgrade to 9.6 or later and confirm the details in the project advisory.
What's affected
The record lists lollms as affected and says the issue affects the latest version prior to 9.6. The weakness is CWE-29 (path traversal using backslash sequences), CWE-22 (path traversal). The description points at the sanitize_path_from_endpoint and sanitize_path functions in lollms_core/lollms/security.py, and says the problem appears when the application runs on Windows. The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing no privileges and no user interaction.
The description says successful use could expose sensitive files, and could also cause a denial of service by pulling in many large files. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The record does not name an exact fixed release number beyond saying versions before 9.6 are affected. I could not read the linked commit or the Huntr report, so confirm the fixed version in the project's release notes.
How to check if you're exposed
lollms is a Python project. On each machine, check the installed version with the command below, and compare it with 9.6.
pip show lollms
Also check whether the service runs on Windows hosts and whether its web interface is reachable from outside. Windows deployments are the ones the description calls out. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Find every lollms install and note its version.
- Upgrade to 9.6 or later, and read the release notes to confirm the fix.
- Do not expose the lollms web interface to the internet. Put it behind authentication and a VPN if remote access is needed.
- Run the service under a low privilege Windows account that cannot read secrets or other users' files.
- Review access logs for requests with unusual path segments.
Why it matters
Path traversal happens when a program builds a file path from user input and the checks meant to keep it inside one folder can be bypassed. The description says the sanitizing functions did not handle the input well enough on Windows, which has its own path separators and rules. Checks written with one platform in mind often miss these.
The lesson for developers is to resolve the final path and compare it to the allowed base folder after resolution, instead of trying to strip bad characters from the input. Run services with a file system account that can read only what it needs.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Does this affect Linux or macOS installs?
The description says the arbitrary file read occurs when the application is running on Windows. Still upgrade other hosts, since the same code is being replaced.
Sources
- NVD record data for CVE-2024-3429
- Reference links listed in the record (project commit and Huntr report), not fetched for this post: https://github.com/parisneo/lollms/commit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9, https://huntr.com/bounties/fd8f50c8-17f0-40be-a2c6-bb8d80f7c409
Last reviewed: 19 October 2026.
