CVE-2026-0558highCWE-287

CVE-2026-0558: falha de alta gravidade em parisneo/lollms

Unauthenticated File Upload in parisneo/lollms

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar parisneo/lollms+ Monitorar lollms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 2.0%
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
parisneo · parisneo/lollms
CVEs relacionadas — parisneo/lollms

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0560HIGHServer-Side Request Forgery (SSRF) in parisneo/lollmsEPSS 1.8%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.3%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2024-4078CRITICALArbitrary Code Execution in parisneo/lollmsEPSS 0.9%