Is CVE-2024-3429 actively exploited?

No active exploitation of CVE-2024-3429 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-3429 be exploited remotely?

Yes. CVE-2024-3429 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-3429?

CVE-2024-3429 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2024-3429

CRITICAL

CVE-2024-3429

CWE-29Published: June 6, 2024· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.

NVD Source

Technical Analysis

CVE-2024-3429 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.