CVE-2026-0558highCWE-287

CVE-2026-0558: high-severity vulnerability in parisneo/lollms

Unauthenticated File Upload in parisneo/lollms

Published · Updated

Follow this CVE+ Monitor parisneo/lollms+ Monitor lollms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 2.0%
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
parisneo · parisneo/lollms
Related CVEs — parisneo/lollms

In the same product, most dangerous first.

CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0560HIGHServer-Side Request Forgery (SSRF) in parisneo/lollmsEPSS 1.8%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.3%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2024-4078CRITICALArbitrary Code Execution in parisneo/lollmsEPSS 0.9%