Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-4326 Details

Description

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e	CVE	Patch
https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd	CVE	ExploitIssue TrackingPatchThird Party Advisory
https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e	[email protected]	Patch
https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd	[email protected]	ExploitIssue TrackingPatchThird Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-15	External Control of System or Configuration Setting	[email protected]

Affected Products

Product	Versions
lollms lollms web ui	< 9.5
CPE cpe:2.3:a:lollms:lollms_web_ui:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Jul 9, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 16, 2024	New CVE Received	[email protected]