Lollms
Monthly
{friendship_id}` endpoint. The vulnerability enables any logged-in user to accept or reject friendship requests by manipulating the `friendship_id` parameter without authorization checks, leading to unauthorized social graph manipulation and potential account compromise via social engineering. Fixed in version 2.2.0 with commit c462977; no public exploit identified at time of analysis, though the attack is trivially reproducible with standard HTTP tools given the low complexity (CVSS AC:L) and authenticated network access (CVSS AV:N/PR:L).
Server-Side Request Forgery (SSRF) in parisneo/lollms versions before 2.2.0 allows unauthenticated remote attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints via the `/api/files/export-content` endpoint. The vulnerability stems from insufficient URL validation in the `_download_image_to_temp()` function, enabling internal network reconnaissance, access to cloud instance metadata (AWS/GCP/Azure), and potential remote code execution through server-side exploitation chains. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch available in commit 76a54f0 and version 2.2.0.
Unauthenticated file upload in parisneo/lollms versions ≤2.2.0 enables remote attackers to submit arbitrary files for text extraction without authentication via the `/api/files/extract-text` endpoint. The vulnerability (CWE-287: Improper Authentication) allows resource exhaustion DoS attacks and potential information disclosure, with CVSS 7.5 (High) reflecting network-accessible attack surface requiring no privileges. EPSS data not available; no public exploit identified at time of analysis, though the simplicity (AC:L, PR:N) suggests trivial exploitation once endpoint details are known.
{friendship_id}` endpoint. The vulnerability enables any logged-in user to accept or reject friendship requests by manipulating the `friendship_id` parameter without authorization checks, leading to unauthorized social graph manipulation and potential account compromise via social engineering. Fixed in version 2.2.0 with commit c462977; no public exploit identified at time of analysis, though the attack is trivially reproducible with standard HTTP tools given the low complexity (CVSS AC:L) and authenticated network access (CVSS AV:N/PR:L).
Server-Side Request Forgery (SSRF) in parisneo/lollms versions before 2.2.0 allows unauthenticated remote attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints via the `/api/files/export-content` endpoint. The vulnerability stems from insufficient URL validation in the `_download_image_to_temp()` function, enabling internal network reconnaissance, access to cloud instance metadata (AWS/GCP/Azure), and potential remote code execution through server-side exploitation chains. EPSS data not available; no public exploit identified at time of analysis. Vendor-released patch available in commit 76a54f0 and version 2.2.0.
Unauthenticated file upload in parisneo/lollms versions ≤2.2.0 enables remote attackers to submit arbitrary files for text extraction without authentication via the `/api/files/extract-text` endpoint. The vulnerability (CWE-287: Improper Authentication) allows resource exhaustion DoS attacks and potential information disclosure, with CVSS 7.5 (High) reflecting network-accessible attack surface requiring no privileges. EPSS data not available; no public exploit identified at time of analysis, though the simplicity (AC:L, PR:N) suggests trivial exploitation once endpoint details are known.