Description
A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.
Published: 2024-07-06
Score: 5.8 Medium
EPSS: 2.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

No history.

Subscriptions

Mudler Localai
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2024-08-01T21:33:03.282Z

Reserved: 2024-06-17T18:56:07.507Z

Link: CVE-2024-6095

cve-icon Vulnrichment

Updated: 2024-08-01T21:33:03.282Z

cve-icon NVD

Status : Modified

Published: 2024-07-06T18:15:02.277

Modified: 2026-06-17T08:17:16.520

Link: CVE-2024-6095

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)