CVE-2026-0560highCWE-918

CVE-2026-0560: fallo de gravedad alta en parisneo/lollms

Server-Side Request Forgery (SSRF) in parisneo/lollms

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear parisneo/lollms+ Monitorear lollms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.5epss 1.8%
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
parisneo · parisneo/lollms
CVEs relacionadas — parisneo/lollms

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0558HIGHUnauthenticated File Upload in parisneo/lollmsEPSS 2.0%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.3%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2024-4078CRITICALArbitrary Code Execution in parisneo/lollmsEPSS 0.9%