What is the CVSS score of EUVD-2026-54864?

EUVD-2026-54864 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of LoLLMs are affected by EUVD-2026-54864?

ParisNeo's lollms 2.1.0 contains a path traversal vulnerability enabling unauthenticated remote attackers to read arbitrary files from affected servers, creating direct exposure to sensitive…. A patch is available.

How to fix or mitigate EUVD-2026-54864?

Within 24 hours, complete an asset inventory of all lollms 2.1.0 instances across production and staging environments and restrict network access through firewall rules or network segmentation-disable internet-facing exposure if operationally feasible. Within 7 days, audit server access logs for path traversal exploitation attempts (URL-encoded sequences like %2e%2e), implement Web Application Firewall rules to block such requests, and review access control logs for unauthorized file read attempts. Within 30 days, monitor the ParisNeo project repository for patch release, validate any available patch thoroughly in a non-production staging environment before deployment, and if no patch is released by day 60, activate migration planning to an alternative solution or establish permanent architectural isolation controls.

LoLLMs EUVD-2026-54864

| CVE-2026-10595 HIGH

Relative Path Traversal (CWE-23)

2026-08-09 @huntr_ai

GHSA-37c2-pxv8-c2mx

Python Path Traversal Parisneo Lollms Parisneo

7.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable HTTP endpoint (AV:N), no authentication or configuration prerequisite (PR:N, AC:L), read-only arbitrary file disclosure (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 09, 2026 - 05:01 EUVD

Source Code Evidence Fetched

Aug 09, 2026 - 04:28 vuln.today

Analysis Generated

Aug 09, 2026 - 04:28 vuln.today

CVE Published

Aug 09, 2026 - 03:52 cve.org

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (%2e%2e) bypass Starlette's built-in path normalization and are resolved by Python's pathlib, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.

AnalysisAI

Path traversal in parisneo/lollms 2.1.0 exposes arbitrary server files to unauthenticated remote attackers via the SPA catch-all route in backend/routers/ui.py. URL-encoded dot-dot sequences (%2e%2e) bypass Starlette's built-in path normalization and are decoded by Python's pathlib.resolve(), allowing directory escape from the static file root with no privileges or user interaction required. No public exploit has been independently confirmed at time of analysis, though the public fix commit at GitHub fully documents the vulnerable code pattern and the bypass technique, substantially lowering the bar for exploit development.

Technical ContextAI

LoLLMs is a Python-based AI assistant and LLM orchestration platform built on FastAPI/Starlette. The affected component is the SPA catch-all route, which serves static frontend assets by joining a user-controlled path segment directly onto STATIC_DIR using pathlib's / operator. The flaw emerges from a mismatch between two layers: Starlette's routing normalizes standard ../ sequences but does not decode percent-encoded equivalents such as %2e%2e/ before passing them to application logic. Python's pathlib.Path.resolve() does perform percent-decoding, so STATIC_DIR / '%2e%2e/etc/passwd' resolves to an absolute path outside the intended directory root. CWE-23 (Relative Path Traversal) precisely describes this root cause class - unsanitized user-controlled relative path components used in filesystem operations without containment enforcement. The fix, visible in commit 9bc6431, introduces Path.resolve() on both the candidate path and the base directory followed by an is_relative_to() check to enforce containment before serving any file.

RemediationAI

Upgrade to LoLLMs version 3 or later, which enforces filesystem containment via Path.resolve() and is_relative_to() in the SPA catch-all route. The patch is available at https://github.com/parisneo/lollms/commit/9bc6431ae7b708da76d51e7626a7cf48ff2b1d24 and full disclosure at https://huntr.com/bounties/af3f40a3-38a1-49d8-a5ae-3d72b9b05b98. If an immediate upgrade is not feasible, place a reverse proxy such as nginx in front of the LoLLMs instance and configure request filtering to reject or normalize URLs containing percent-encoded dot sequences (%2e) before they reach the Python application - note this approach adds operational complexity and may not catch all multi-encoding variants, making it an imperfect compensating control. A more reliable interim measure is restricting network access to the LoLLMs web interface to trusted hosts only (firewall or network segmentation), which eliminates unauthenticated remote exposure while upgrade is coordinated. Running the LoLLMs process under a dedicated low-privilege OS account with minimal filesystem read permissions limits the blast radius of exploitation even if the flaw is triggered.