LolLMS <= 2.2.0 - Unauthenticated File Upload
CVE-2026-0558
Verified
Description
A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Depends(get_current_active_user) dependency used by other file-related APIs.
Severity
Critical
CVSS Score
9.8
Exploit Probability
2%
Affected Product
lollms
Published Date
May 21, 2026
Template Author
koungq
CVE-2026-0558.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-0558
CWE ID:
cwe-287
Remediation Steps
Update to a patched version containing commit a6625dc83786ff21d109b0d545ca61b770607ef3 or later. Restrict unauthenticated access to /api/files/extract-text until the update is applied.