PT-2026-1063 · Parisneo · Lollms

CVE-2026-0558 · Published 2025-12-29 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions through 2.2.0

Description An issue exists in parisneo/lollms that allows unauthenticated users to upload and process files. The /api/files/extract-text endpoint does not require authentication, unlike other file-related endpoints, and is missing the Depends(get current active user) dependency. This can result in denial of service (DoS) through resource exhaustion, information disclosure, and a violation of the application’s security policies. The vulnerable API endpoint is /api/files/extract-text.

Recommendations Versions through 2.2.0 should be updated to a version where the /api/files/extract-text endpoint enforces authentication using Depends(get current active user).

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2026-06472

CVE-2026-0558

PYSEC-2026-2198

Affected Products

Lollms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0558.json · Exploit
• 🔥 https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113 · Exploit
• https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3 · Patch
• https://bdu.fstec.ru/vul/2026-06472 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0558 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2198 · Vendor Advisory
• https://twitter.com/aydinnyunuss/status/2007051547474337840 · Twitter Post
• https://twitter.com/CVEnew/status/2038516978223325544 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039249399042486728 · Twitter Post