CVE-2026-10595: Relative Path Traversal

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

PT-2026-69253

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 3 Description A path traversal issue exists in the SPA catch-all route implemented in backend/routers/ui.py. The flaw occurs because user-controlled path input is joined into a filesystem path without proper...

CVE-2026-1115

A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...

CVE-2026-1115: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...

CVE-2026-0560: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the /api/files/export-content endpoint. The downloadimagetotemp function in backend/routers/files.py fails to validate user-controlled URLs, allowing attackers to make arbitrary HTT...

CVE-2026-0562: Incorrect Authorization

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The respondrequest function in backend/routers/friends.py does not implement proper authorization checks, enabling Insecure Direct...

PT-2025-55190

Уязвимость сценария backend/routers/files.py системы для запуска и управления большими языковыми моделями LoLLMS Lord of Large Language Multimodal Systems связана с неограниченной загрузкой файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, записывать...

PT-2025-55186

Уязвимость сценария backend/routers/files.py системы для запуска и управления большими языковыми моделями LoLLMS Lord of Large Language Multimodal Systems связана с недостатками процедуры аутентификации при обработке конечной точки /api/files/extract-text. Эксплуатация уязвимости может позволить...