PYSEC-2026-1594

vendorUSosv

lollms vulnerable to dot-dot-slash path traversal in XTTS server

view advisory published 2026-07-07Licence: CC-BY-4.0

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in the `tts_to_file` endpoint.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-6139US	—	0.52% (44th)	—	2024-06-27
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locati…

references

External citations — patches, advisories, analysis.

https://github.com/ParisNeo/lollmsPACKAGE
https://github.com/advisories/GHSA-w9qf-83jg-2x6cADVISORY
https://huntr.com/bounties/fd00f112-efd0-40a1-8227-d6733716e4c0WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-6139ADVISORY
https://pypi.org/project/lollmsPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan