Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-cpcx-r2gq-x893: LocalAI path traversal vulnerability

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the model parameter.

ghsa
#vulnerability#git
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2024-5182

LocalAI path traversal vulnerability

High severity GitHub Reviewed Published Jun 20, 2024 to the GitHub Advisory Database • Updated Jun 20, 2024

Package

gomod github.com/go-skynet/LocalAI (Go)

Affected versions

< 2.16.0

Published to the GitHub Advisory Database

Jun 20, 2024

Last updated

Jun 20, 2024

ghsa: Latest News

GHSA-mj5r-x73q-fjw6: SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails