CVE-2024-6095 Scanner
CVE-2024-6095 scanner - Local File Inclusion vulnerability in LocalAI
Used 2.4k times · 5.9k assets checked · domain, ipv4, subdomain
CVE
CVE-2024-6095
5.8
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
mudler/localailocalai
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: mudler/localai
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →