# lollms_core\\lollms\\extension.py
# ... more code
class ExtensionBuilder:
 def build_extension(
 self,
 extension_path:str,
 lollms_paths:LollmsPaths,
 app,
 installation_option:InstallOption=InstallOption.INSTA
LL_IF_NECESSARY
 )->LOLLMSExtension: 10
 extension, script_path = self.getExtension(extension_
path, lollms_paths, app) # [8]
 return extension(app = app, installation_option = ins
tallation_option)
 def getExtension(
 self,
 extension_path:str,
 lollms_paths:LollmsPaths,
 app
 )->LOLLMSExtension:
 extension_path = lollms_paths.extensions_zoo_path / e
xtension_path
 # define the full absolute path to the module
 absolute_path = extension_path.resolve()
 # infer the module name from the file path
 module_name = extension_path.stem
 # use importlib to load the module from the file path
 loader = importlib.machinery.SourceFileLoader(module_
name, str(absolute_path / "__init__.py")) # [9]
 extension_module = loader.load_module()
 extension:LOLLMSExtension = getattr(extension_module,
extension_module.extension_name)
 return extension, absolute_path
Path Traversal leads to Remote Code Execution in parisneo/lollms
