CVE-2024-8898 is a critical (CVSS 9.8) path traversal in the install and uninstall API endpoints of parisneo/lollms-webui V12 (Strawberry). Input was not sanitized, so directories could be created or deleted at arbitrary paths. The upstream commit adds path sanitization, so update to a build that includes it.
What's affected
The record names parisneo/lollms-webui version V12, also called Strawberry. The affected endpoints are the install and uninstall routes of the apps zoo, which handle apps by name.
The upstream commit, titled "fixed sanitization lack in apps zoo", adds a sanitize_path call to the app name in the install and uninstall handlers, and to two parameters of the assets route. That confirms the cause: a name from the request was used to build a filesystem path without cleaning.
The record says attackers can create or delete directories with arbitrary paths. The uninstall handler removes a directory tree, so the deletion side is the more serious one. We did not find a release number in the sources, so use a build that contains the commit and check the project's releases.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show lollms
pip list | grep -i lollms
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for lollms and read the pinned version.
If you run the web UI from a git checkout rather than from pip, check whether your copy includes the commit with the sanitization change, and look at who can reach the UI. These tools often listen on all interfaces by default.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- Find lollms-webui deployments and note the version or commit.
- Update to a build that includes the sanitize_path change.
- Do not expose the UI to the internet; bind it to localhost or a private network.
- Put authentication in front of any shared instance.
- Run the service as a user with a narrow home folder and keep backups.
- Review the other routes that take names from the request for the same pattern.
Why it matters
When an app name is used as part of a path, a name like a parent directory reference lets the program step outside its own folder. Install and uninstall handlers are risky since they create and remove whole directories.
The class is path traversal. The upstream fix cleans the name before use, which is the right direction, and a second line of defense is to resolve the final path and refuse anything outside the apps folder. A local AI web UI is often run casually, but once it is reachable from other machines it needs the same care as any web service.
The weakness class is CWE-22: Path Traversal. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Which endpoints are affected?
The record names the install and uninstall API endpoints.
Can I confirm my copy is fixed?
Check that your code includes the sanitize_path calls from the upstream commit, or use a release that does.
Sources
Last reviewed: 19 October 2026.
