PT-2026-27456 · Unknown · Lollms-Webui

Regaan · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33340

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LoLLMs WEBUI (affected versions not specified)

Description LoLLMs WEBUI provides the web user interface for Lord of Large Language and Multi modal Systems. A Server-Side Request Forgery (SSRF) issue exists in all known versions of lollms-webui. The /api/proxy endpoint allows unauthenticated attackers to make arbitrary GET requests, potentially enabling access to internal services, local network scanning, and the exfiltration of sensitive cloud metadata.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

SSRF

Weakness Enumeration

CWE-306

CWE-918

Related Identifiers

CVE-2026-33340

Affected Products

Lollms-Webui

References · 5

• 🔥 https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33340 · Security Note
• https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450 · Note
• https://twitter.com/CveFindCom/status/2036498945266913735 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036482991073956072 · Twitter Post