High severity · published Mar 29, 2026
CVE-2026-0560
Server-Side Request Forgery (SSRF) in parisneo/lollms
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parisneo/lollms · parisneo
before 2.2.0 · source: vendor
LO
Lollms · Lollms
through 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0560
Patch
https://github.com/parisneo/lollms/commit/76a54f0df2df8a5b254aa627d487b5dc939a0263
Exploit
https://huntr.com/bounties/65e43a5e-b902-4369-b738-1825285a3ea5
More from parisneo/lollms
9.8
CVE-2026-1114
Improper Access Control via Weak JWT Token in parisneo/lollms
9.8
CVE-2026-0558
Unauthenticated File Upload in parisneo/lollms
9.6
CVE-2026-1115
Stored XSS in parisneo/lollms
8.4
CVE-2024-6982
Remote Code Execution in Calculate Function in parisneo/lollms
8.3
CVE-2026-0562
Insecure Direct Object Reference (IDOR) in parisneo/lollms