A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Parisneo |
|
No data.
No data.
References
History
Mon, 30 Mar 2026 07:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Parisneo
Parisneo parisneo/lollms |
|
| Vendors & Products |
Parisneo
Parisneo parisneo/lollms |
Sun, 29 Mar 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution. | |
| Title | Server-Side Request Forgery (SSRF) in parisneo/lollms | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2026-03-29T17:51:20.708Z
Reserved: 2026-01-01T22:10:15.839Z
Link: CVE-2026-0560
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-29T18:16:14.303
Modified: 2026-03-30T13:26:07.647
Link: CVE-2026-0560
Redhat
No data.