CVE-2024-6139

Advisory

Affected versions of the lollms package are vulnerable to Path Traversal due to improper validation of user-provided file paths in the tts_to_file endpoint. The `tts_to_file` endpoint in the XTTS server fails to sanitize path components, allowing directory traversal beyond the intended audio output directory. An attacker can exploit this by providing crafted file paths to cause the lollms package to write audio files to arbitrary locations on the host filesystem and to enumerate directory structure, potentially overwriting files or exposing sensitive system paths.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/fd00f112-efd0-40a1-8227-d6733716e4c0
• https://github.com/advisories/GHSA-w9qf-83jg-2x6c
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6139