Headline
GHSA-cpcx-r2gq-x893: LocalAI path traversal vulnerability
A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model
parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model
parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the model
parameter.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-5182
LocalAI path traversal vulnerability
High severity GitHub Reviewed Published Jun 20, 2024 to the GitHub Advisory Database • Updated Jun 20, 2024
Package
gomod github.com/go-skynet/LocalAI (Go)
Affected versions
< 2.16.0
Published to the GitHub Advisory Database
Jun 20, 2024
Last updated
Jun 20, 2024