CVE-2024-3121

CVE-2024-3121 - parisneo/lollms 中的远程代码执行（RCE） 发现者： Syed Jan Muhammad Zaidi GitHub： dark-ninja10 CVE ID： CVE-2024-3121 受影响仓库： parisneo/lollms 🧨 漏洞摘要 lollms 框架的 createcondaenv 函数中存在一个远程代码执行（RCE）漏洞。该函数使用未经过滤的输入构造系统命令，允许攻击者注入任意命令并在主机上获得代码执行能力。 🔥 影响 能够访问 envname 输入参数的攻击者可以执行任意操作系统级命令。这可能导致： 完全控制系统...

LoLLMs WEBUI - Server-Side Request Forgery

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication. id: CVE-2026-33340 info: name: LoLLMs WEBUI - Server-Side Request Forgery author:...

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

LolLMS < 2.2.0 - Server-Side Request Forgery

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via downloadimagetotemp in backend/routers/files.py without any validation, allowing an unauthenticated...

parisneo/lollms < 2.2.0 - Authenticated Stored XSS

parisneo/lollms 2.2.0 contains a stored XSS caused by unsanitized user input in createpost function in backend/routers/social/init.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission. id: CVE-2026-1115 info: name: parisneo/lollms 2.2....

LolLMS <= 2.2.0 - Unauthenticated File Upload

A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Dependsgetcurrentactiveuser dependency used by other file-related APIs. id: CVE-2026-0558 info: name:...

LOLLMS WebUI - Absolute Path Traversal

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...

POC_CVE-2024-4322

CVE-2024-4322: PoC de LoLLMS WebUI y laboratorio de validación con Nuclei Este repositorio proporciona laboratorios locales Dockerizados para reproducir CVE-2024-4322 , una vulnerabilidad de path traversal en LoLLMS WebUI v9.6, y para validar que la plantilla de Nuclei asociada no coincide con...

CVE-2026-33340

CVE-2026-33340：lollms-webui 中的 SSRF 漏洞 概述 字段| 详情 ---|--- CVE ID| CVE-2026-33340 漏洞类型| 服务端请求伪造（Server-Side Request Forgery, SSRF） 受影响产品| ParisNeo/lollms-webui（LoLLMs WEBUI） 严重等级| 严重 — CVSS 9.1 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918：服务端请求伪造（SSRF） 受影响组件|...

CVE-2026-10595

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

EUVD-2026-54864

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-10595

Summary: CVE-2026-10595 affects parisneo/lollms 2.1.0. A path traversal flaw in the SPA catch-all route (backend/routers/ui.py) allows an unauthenticated attacker to read arbitrary server files by manipulating user-controlled paths. The issue stems from directly joining input into a filesystem pa...

Exploit for Server-Side Request Forgery in Lollms

CVE-20...

CVE-2026-12228 Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

PYSEC-2026-2612 parisneo/lollms has an insufficient session expiration vulnerability

An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject reques...

PYSEC-2026-1590 Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function

The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...

PYSEC-2026-1591 LoLLMS Code Injection vulnerability

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...