CVE-2026-0560

HighPublished

Server-Side Request Forgery (SSRF) in parisneo/lollms

Published: Mar 29, 2026
Updated: Mar 30, 2026
Assigning CNA: @huntr_ai
Evidence observed: Aug 28, 2026

Primary CVSS

7.5/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

1.8%

Low · next 30 days

Percentile: 77.7%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

LolLMS < 2.2.0 - Server-Side Request ForgeryTemplate
http/cves/2026/CVE-2026-0560.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 008731b339bdRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.