ParisNeo vulnerabilities
We track 65 vulnerabilities in ParisNeo products across 5 products. 65 are rated high or critical, and none are known to be exploited. The most recent was published on August 9, 2026.
Latest ParisNeo vulnerabilities
- 7.5 High severity
parisneo/lollms: Relative Path Traversal
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined
- 9.6 Critical severity
parisneo/lollms: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the `create_post` function within `backend/routers/social/__init__.py`, where us
- 9.8 Critical severity
parisneo/lollms: Improper Access Control
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attac
- 8.3 High severity
parisneo/lollms: Incorrect Authorization
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper aut
- 7.5 High severity
parisneo/lollms: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-contro
- 9.8 Critical severity
parisneo/lollms: Improper Authentication
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints,
- 9.1 Critical severity
lollms-webui: Missing Authentication for Critical Functionality
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")`
- 9.6 Critical severity
parisneo/lollms-webui: Path Traversal: '..filename'
A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the `@router.post("/reinstall_extension")` route. This vulnerability allows attackers
- 8.2 High severity
parisneo/lollms: Improper Access Control
A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `gener
- 7.5 High severity
parisneo/lollms: Observable Discrepancy
The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by an
- 7.5 High severity
parisneo/lollms-webui: Allocation of Resources Without Limits or Throttling
A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests wi
- 8.8 High severity
parisneo/lollms-webui: Unrestricted Upload of File with Dangerous Type
In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and
- 8.4 High severity
parisneo/lollms-webui: Missing Authentication for Critical Functionality
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabli
- 7.1 High severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the `key` parameter, which is used to constr
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due
- 9.1 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal er
- 8.4 High severity
parisneo/lollms: Improper Control of Generation of Code
A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval()` function to evaluate mathematical expressions within a Python sandbox that disables `__builtins__`
- 7.5 High severity
parisneo/lollms-webui: Server-Side Request Forgery
parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resource
- 8.0 High severity
parisneo/lollms: Missing Critical Step in Authentication
A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoi
- 7.3 High severity
parisneo/lollms-webui: Improper Neutralization of Input During Web Page Generation
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code
- 7.1 High severity
parisneo/lollms-webui: Origin Validation Error
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to p
- 9.0 Critical severity
parisneo/lollms: Improper Neutralization of Input During Web Page Generation
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which
- 7.1 High severity
parisneo/lollms-webui: Cross-Site Request Forgery
A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each cha
- 7.5 High severity
parisneo/lollms-webui: Path Traversal: '..filename'
A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead
- 8.8 High severity
parisneo/lollms: Cross-Site Request Forgery
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_ac
- 7.3 High severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potenti
- 8.4 High severity
parisneo/lollms-webui: Improper Neutralization of Equivalent Special Elements
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'b
- 7.5 High severity
parisneo/lollms-webui: Absolute Path Traversal
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_path` function with `allow_absolute_path=True` allows an attacker to access arbitrary files and direc
- 7.3 High severity
parisneo/lollms: Path Traversal: '..filename'
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper valid
- 8.6 High severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against pa
- 7.4 High severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as
- 7.7 High severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the `/apply_settings` function, allowing an at
- 9.8 Critical severity
parisneo/lollms: Path Traversal: '..filename'
CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to na
- 9.1 Critical severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\`), allowing attackers to perform
- 8.8 High severity
parisneo/lollms-webui: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowl
- 8.1 High severity
parisneo/lollms-webui: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection.
- 7.5 High severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environm
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of t
- 9.8 Critical severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the app
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'process