An unauthenticated path traversal vulnerability in lollms exposes sensitive system files to unauthorized remote access.

The application lacks sufficient input validation, permitting an unauthenticated attacker to use directory traversal sequences to read files outside of the intended web root.

With a CVSS score of 7.5, this high-severity vulnerability poses a major risk of sensitive data exposure, including configuration files, credentials, or system data. Successful exploitation could lead to full compromise of the application context and potentially facilitate further attacks against the underlying host.

Immediate Action: Upgrade to version 3 or the latest available release to ensure the path traversal flaw is resolved.

Proactive Monitoring: Review web server access logs for patterns containing directory traversal characters such as dot-dot-slash sequences.

Compensating Controls: Deploy a Web Application Firewall to block requests containing directory traversal payloads.

Public Exploit Available: No

Administrators must treat this vulnerability with urgency due to the potential for unauthorized file access. Update the lollms instance to version 3 immediately to mitigate the risk of information disclosure.