CVE-2026-0560highCWE-918

CVE-2026-0560: falha de alta gravidade em parisneo/lollms

Server-Side Request Forgery (SSRF) in parisneo/lollms

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar parisneo/lollms+ Monitorar lollms

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 1.8%
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
parisneo · parisneo/lollms
CVEs relacionadas — parisneo/lollms

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3429CRITICALPath Traversal in parisneo/lollmsEPSS 28.3%CVE-2026-0558HIGHUnauthenticated File Upload in parisneo/lollmsEPSS 2.0%CVE-2026-1115CRITICALStored XSS in parisneo/lollmsEPSS 1.3%CVE-2024-5443CRITICALRemote Code Execution via Path Traversal in parisneo/lollmsEPSS 1.2%CVE-2024-4315CRITICALLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsEPSS 1.0%CVE-2024-4078CRITICALArbitrary Code Execution in parisneo/lollmsEPSS 0.9%