VULNERABILITY INTELLIGENCE
CVE-2024-6139
CVSS score7.3 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2024-06-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.
Weakness classification
- security@huntr.dev: CWE-29