LLaMA Factory's Chat API enthält CRITICAL SSRF und LFI Schwachstellen

The SSRF vulnerability in llamafactory allows an attacker, once authenticated, to craft malicious requests that the server will execute on their behalf. This can be leveraged to scan the internal network for exposed services, interact with third-party APIs without proper authorization, or even attempt to access sensitive data stored within the internal network. The LFI component amplifies the impact, allowing attackers to read arbitrary files from the server's filesystem, potentially including configuration files, source code, or other sensitive information. A successful exploitation could lead to significant data breaches, system compromise, and lateral movement within the network.

Organizations deploying llamafactory in production environments, particularly those with internal services accessible via HTTP or HTTPS, are at risk. Environments with weak authentication or inadequate network segmentation are especially vulnerable. Shared hosting environments where multiple users share the same llamafactory instance are also at increased risk.

• python / server:

import requests
import urllib.parse

def check_ssrf(url):
    try:
        parsed_url = urllib.parse.urlparse(url)
        if parsed_url.scheme in ('http', 'https'):
            response = requests.get(url, timeout=5)
            if response.status_code != 200:
                print(f"Potential SSRF detected: {url} - Status Code: {response.status_code}")
            else:
                print(f"URL {url} accessible.")
        else:
            print(f"Invalid URL scheme: {url}")
    except requests.exceptions.RequestException as e:
        print(f"Error accessing {url}: {e}")

# Example usage (replace with actual URL patterns)
check_ssrf("http://localhost:8080")
check_ssrf("http://169.254.169.254/latest/meta-data/")

• generic web:

curl -I 'http://your-llamafactory-server/api/chat?message=http://internal-service/'

• linux / server:

journalctl -u llamafactory -f | grep -i "request:"

1. 2025-10-07Disclosure

   disclosure

1. Reserviert2025-09-30
2. Veröffentlicht2025-10-07
3. Geändert2026-03-19
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-61784 is to upgrade to llamafactory version 0.9.4 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access for the llamafactory service to only trusted destinations. Implement strict authentication and authorization controls to limit the number of authenticated users with access to the chat API. Monitor network traffic for unusual outbound requests originating from the llamafactory service. Review and harden the server's filesystem permissions to minimize the impact of a potential LFI attack. After upgrade, confirm by verifying the version number and testing the chat API functionality to ensure the vulnerability is no longer present.