LoLLMs CVE-2026-10595

No special conditions are required - the CVSS vector PR:N/UI:N/AC:L confirms unauthenticated, zero-interaction exploitation against any network-reachable LoLLMs 2.1.0 instance running the default configuration. The vulnerability is triggered via standard HTTP GET requests to the SPA catch-all route, which is active in the default deployment. The primary limiting factor is filesystem privilege: an attacker can only read files accessible to the OS account running the LoLLMs process, so sensitive material outside that account's read permissions is not exposed. The vulnerability does not provide write access, code execution, or privilege escalation through this vector alone. Deployments that are air-gapped, bound to localhost only, or placed behind authentication-enforcing reverse proxies have a substantially reduced attack surface despite the flaw being present in the code.

The CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the exploitability profile: the attack is fully remote, requires zero authentication or user interaction, and has low complexity - all characteristics that make it trivially automatable. Confidentiality impact is rated High, meaning arbitrary file disclosure up to the privilege level of the LoLLMs process account. No EPSS data was present in the provided intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. However, the public GitHub commit documents the exact vulnerable code and the bypass technique (%2e%2e), which functions as de facto exploit documentation. The Scope:Unchanged rating (S:U) correctly limits the blast radius - an attacker can read files the process user can read, but cannot directly pivot to other systems through this flaw alone. Real-world severity depends heavily on what sensitive material is readable by the LoLLMs process: configuration files containing API keys, credentials, or private keys would represent a critical secondary impact beyond the raw CVSS score suggests.

An unauthenticated attacker sends an HTTP GET request to the LoLLMs web interface with a path containing URL-encoded traversal sequences, for example GET /%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1. Starlette's routing passes the undecoded path to the SPA catch-all handler, where pathlib resolves it to /etc/passwd outside the static directory, and the file contents are returned directly in the HTTP response. The public fix commit documents both the vulnerable code and the bypass technique, providing an effective blueprint for exploit construction.