/Vulnerability Library

LolLMS <= 2.2.0 - Unauthenticated File Upload

CVE-2026-0558
Verified

Description

A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Depends(get_current_active_user) dependency used by other file-related APIs.

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Affected Product

lollms

Published Date

May 21, 2026

Template Author

koungq

CVE-2026-0558.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-0558
CWE ID:
cwe-287

References

https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113https://nvd.nist.gov/vuln/detail/CVE-2026-0558

Remediation Steps

Update to a patched version containing commit a6625dc83786ff21d109b0d545ca61b770607ef3 or later. Restrict unauthenticated access to /api/files/extract-text until the update is applied.