CVE-2026-0558 Details
Description
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.
A vulnerability exists in Parisneo Lollms versions through 2.2.0, allowing unauthenticated users to upload files via the '/api/files/extract-text' endpoint. This endpoint lacks authentication, contrary to the application's stated security policies, and does not require a token for access. The vulnerability can lead to denial-of-service through resource exhaustion, as uploaded files are processed without any access controls, potentially disclosing sensitive information.
The vulnerability has been fixed in version 2.2.0 by adding authentication requirements to the endpoint. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3 | [email protected] | Patch |
| https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113 | [email protected] | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lollms lollms | <= 2.1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 29, 2026 | New CVE Received | [email protected] |