Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: parisneo/lollms 2.2.0 Clear all filters
TI-2026-00360 CVE-2026-0558 · GHSA-4574-jvgw-55gr

Unauthenticated File Upload in parisneo/lollms

Priority HIGH 81

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02047 Published 2026-03-29 Fixed in 2.2.0 CWE-287
TI-2026-00362 CVE-2026-0560 · GHSA-rqmp-494m-8qgf

Server-Side Request Forgery (SSRF) in parisneo/lollms

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01765 Published 2026-03-29 Fixed in 2.2.0 CWE-918
TI-2026-00364 CVE-2026-0562 · GHSA-2j48-mfm5-x2hv

Insecure Direct Object Reference (IDOR) in parisneo/lollms

Priority HIGH 71

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00273 Published 2026-03-29 Fixed in 2.2.0 CWE-863