PT-2026-1063 · Parisneo · Lollms

CVE-2026-0558 · Publicado 2025-12-29 · Atualizado 2026-04-01

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions through 2.2.0

Description An issue exists in parisneo/lollms that allows unauthenticated users to upload and process files. The /api/files/extract-text endpoint does not require authentication, unlike other file-related endpoints, and is missing the Depends(get current active user) dependency. This can result in denial of service (DoS) through resource exhaustion, information disclosure, and a violation of the application’s security policies. The vulnerable API endpoint is /api/files/extract-text.

Recommendations Versions through 2.2.0 should be updated to a version where the /api/files/extract-text endpoint enforces authentication using Depends(get current active user).

Exploit

Correção

Improper Authentication

Missing Authentication

Enumeração de Fraquezas

CWE-287

CWE-306

Identificadores relacionados

BDU:2026-06472

CVE-2026-0558

PYSEC-2026-2198

Produtos afetados

Lollms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0558.json · Exploit
• 🔥 https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113 · Exploit
• https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3 · Correção
• https://bdu.fstec.ru/vul/2026-06472 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-0558 · Aviso do Fabricante
• https://twitter.com/aydinnyunuss/status/2007051547474337840 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038516978223325544 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2039249399042486728 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0558 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2026-2198 · Aviso do Fabricante