GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2024-6581

Vulnerability from fkie_nvd - Published: 2024-10-29 13:15 - Updated: 2026-06-17 08:18
Severity
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and 'on*' event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file.
References
security@huntr.devhttps://github.com/parisneo/lollms/commit/328b960a0de2097e13654ac752253e9541521dddPatch
security@huntr.devhttps://huntr.com/bounties/ad68ecd6-44e2-449b-8e7e-f2b71b1b43c7Exploit, Third Party Advisory
Impacted products
Vendor Product Version
lollms lord_of_large_language_models 9.9
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "parisneo/lollms",
          "vendor": "parisneo",
          "versions": [
            {
              "lessThan": "9.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@huntr.dev"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:parisneo:lollms:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "lollms",
          "vendor": "parisneo",
          "versions": [
            {
              "lessThan": "9.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lollms:lord_of_large_language_models:9.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "B78CB816-A8B4-4155-8E87-C35DEA30ED7D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and \u0027on*\u0027 event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funci\u00f3n de carga de im\u00e1genes de discusi\u00f3n de la aplicaci\u00f3n Lollms, versi\u00f3n v9.9, permite la carga de archivos SVG. Debido a un filtrado incompleto en la funci\u00f3n sanitize_svg, esto puede generar vulnerabilidades de Cross Site Scripting (XSS), que a su vez plantean un riesgo de ejecuci\u00f3n remota de c\u00f3digo. La funci\u00f3n sanitize_svg solo elimina elementos de scripts y atributos de evento \u0027on*\u0027, pero no tiene en cuenta otros vectores potenciales de XSS dentro de los archivos SVG. Esta vulnerabilidad se puede explotar cuando los usuarios autorizados acceden a una URL maliciosa que contiene el archivo SVG creado."
    }
  ],
  "id": "CVE-2024-6581",
  "lastModified": "2026-06-17T08:18:17.043",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 3.7,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6581",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-29T13:17:31.015025Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-29T13:15:07.840",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/parisneo/lollms/commit/328b960a0de2097e13654ac752253e9541521ddd"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/ad68ecd6-44e2-449b-8e7e-f2b71b1b43c7"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.