Server-Side Request Forgery (SSRF) in parisneo/lollms

The SSRF vulnerability in lollms allows an attacker to craft malicious requests through the /api/files/export-content endpoint. Because the application fails to properly validate user-supplied URLs, the server will forward these requests to arbitrary destinations. This can enable attackers to scan internal ports, access sensitive cloud metadata (e.g., AWS instance IDs, Azure credentials), and potentially interact with internal services that are not directly exposed to the internet. A successful attacker could leverage this access to gather information about the internal network topology, identify other vulnerable systems, or even attempt to execute code through vulnerable internal services. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the lollms server.

Organizations deploying lollms in environments with sensitive internal services or cloud metadata are at significant risk. Shared hosting environments where lollms is running alongside other applications are particularly vulnerable, as a compromised lollms instance could be used to pivot to other systems on the same host. Any deployment relying on the /api/files/export-content endpoint without proper input validation is potentially exposed.

• python / server:

# Check for outbound requests to unusual IP ranges in lollms logs
grep -i '169.254.169.254' /var/log/lollms/api.log

• generic web:

# Check access logs for requests to cloud metadata endpoints
grep -i '169.254.169.254' /var/log/nginx/access.log

1. 2026-03-29Disclosure

   disclosure

1. Réservé2026-01-01
2. Publiée2026-03-29
3. Modifiée2026-03-30
4. EPSS mis à jour2026-04-06

The primary mitigation for CVE-2026-0560 is to immediately upgrade lollms to version 2.2.0 or later, which includes the necessary validation to prevent SSRF attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block suspicious outbound requests originating from the /api/files/export-content endpoint. Specifically, WAF rules should be configured to filter requests to unusual or internal IP address ranges, as well as requests targeting cloud metadata endpoints. Additionally, review and restrict network access to the lollms server, limiting its ability to reach internal resources unnecessarily. After upgrade, confirm by attempting a file export request with a known malicious URL and verifying that it is blocked.