2024-06-06 18:40:18
@huntr_ai
PUBLISHED
A path traversal vulnerability exists in the cyber_security/codeguard native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the process_folder function within lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py. Specifically, the function fails to properly sanitize user-supplied input for the code_folder_path, allowing an attacker to specify arbitrary paths using ../ or absolute paths. This flaw leads to arbitrary file read and overwrite capabilities in specified directories without limitations, posing a significant risk of sensitive information disclosure and unauthorized file manipulation.