Unauthenticated code execution via binding path traversal

Command injection in ParisNeo LoLLMS and LoLLMs WebUI 1.4.6 allows remote attackers to execute arbitrary code through a web request. The unInstall_binding handler joins the untrusted name parameter into a binding path without traversal sanitization, then imports an attacker-placed init.py file from the resolved directory. No authentication or user interaction is required; successful exploitation runs code with the server process's privileges and can read, alter, or interrupt its data and services.