LightLLM EUVD-2026-89988

Requires a LightLLM instance (through v1.2.0) serving multimodal input - i.e. a vision or audio model whose endpoint accepts image_url/audio_url parameters - to be network-reachable by the attacker. No authentication, user interaction, or non-default toggle is needed once such an endpoint is exposed, since the parameters are fetched without validation. Exploitation is LIMITED to deployments that expose multimodal endpoints (text-only serving is not in scope) and yields primarily confidentiality/topology disclosure rather than code execution; realistic impact also depends on what internal services (e.g. cloud metadata, internal APIs) are reachable from the server's network position.

This is a genuine but moderate-severity issue rather than an urgent, actively-exploited threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, base 6.9) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated SSRF whose primary impact is limited confidentiality - either disclosure of fetched internal content through the vision model or internal network topology inferred from error responses. There is no KEV listing, no EPSS score provided, and no explicitly published exploit code, so exploitation status is 'no public exploit identified at time of analysis' - though the referenced GitHub issue (#1608) and VulnCheck advisory pin down the exact vulnerable code paths (multimodal_utils.py L82-91 and multimodal_params.py L149), which materially lowers the effort to weaponize. The real-world priority is tempered by two factors not captured in the raw score: LightLLM's comparatively narrow deployment footprint, and the requirement that a multimodal (vision/audio) endpoint actually be exposed. No key signals conflict here; the main gap is the absence of EPSS/KEV data, which is expected for a freshly disclosed open-source issue and should not be read as low risk on its own.

An attacker who can reach an internet-exposed or internal-network LightLLM multimodal endpoint submits an inference request whose image_url or audio_url points at an internal resource (e.g. a cloud metadata endpoint like 169.254.169.254, an internal admin service, or a port-scan target). The server fetches the URL without validation; the vision model's processing of the response, or the differential error messages returned, leak internal content and network topology back to the attacker. No authentication is required and the referenced VulnCheck advisory and GitHub issue identify the exact unvalidated parameters, though no packaged exploit is published.