parisneo lollms-webui Path Traversal and OS Command Injection Vulnerability

A vulnerability exists in the 'start_app_server' function of parisneo/lollms-webui version 12 (Strawberry). This issue allows for path traversal and operating system command injection. The vulnerability arises because the function fails to properly sanitize the 'app_name' parameter, which enables an attacker to upload a malicious 'server.py' file and execute arbitrary code by exploiting the path traversal flaw.

Impact

Exploitation of this vulnerability could lead to unauthorized file access and execution of arbitrary code on the server.