CVE-2024-5443

CRITICAL

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension...

Affects 0 products across 3 vendors.

CVSS 3.09.8
EPSS1.2%
Percentile67th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-29: CWE-29
◆ AI Analysis — automated analysis, not human-reviewed

The parisneo/lollms software contains a critical path traversal vulnerability in the `ExtensionBuilder().build_extension()` function, accessible via the `/mount_extension` endpoint. This allows attackers to navigate beyond the intended directory structure, potentially leading to unauthorized access to sensitive files.

BSID: BS-2024-GLOBAL-224037-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-5443?
The parisneo/lollms software contains a critical path traversal vulnerability in the `ExtensionBuilder().build_extension()` function, accessible via the `/mount_extension` endpoint. This allows attackers to navigate beyond the intended directory structure, potentially leading to unauthorized access to sensitive files.
What is the CVSS score for CVE-2024-5443?
CVE-2024-5443 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.2%.
Is CVE-2024-5443 actively exploited?
No confirmed active exploitation of CVE-2024-5443 as of 2026-09-25.
How do I remediate CVE-2024-5443?
Priority: IMMEDIATE.
What systems are affected by CVE-2024-5443?
CVE-2024-5443 affects Beyond; Lollms; Parisneo.
Vulnerability Details
CVE IDCVE-2024-5443
BSIDBS-2024-GLOBAL-224037-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-06-22
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-29
SourceNVD
Official Description

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadequate input sanitization, can lead to the construction of a `package_path` that points to the root directory. Consequently, if an attacker can create a `config.yaml` file in a controllable path, this path can be appended to the `extensions` list and trigger the execution of `__init__.py` in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is triggered by the `data.category` and `data.folder` parameters accepting empty strings, which can be manipulated to perform path traversal attacks. This can lead to unauthorized file access and manipulation.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Beyond — —
Lollms — —
Parisneo — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 845 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash6ab882ebd5ec11b5d81827cbe4e2e7d8762b32eb828816b18553c904da27a1f664f6a14f9f7afbbdee2acf2b80990b1cfff4e24153368d49b02cf3ec23165afa
Related CVEs affecting Beyond
CVE-2025-68794 9.8 In the Linux kernel, the following vulnerability has been resolved: iomap: a... CVE-2026-26222 9.8 Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 expose... CVE-2025-29922 9.6 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond ... CVE-2026-22806 9.1 vCluster Platform provides a Kubernetes platform for managing virtual cluster... CVE-2026-41445 8.8 KissFFT before commit 8a8e66e contains an integer overflow vulnerability in t...
View all Beyond CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →