Ongemachtigde bestandsupload in parisneo/lollms

The primary impact of CVE-2026-0558 is the ability for an unauthenticated attacker to upload and process files without proper authorization. This opens the door to several malicious scenarios. An attacker could upload large files to exhaust server resources, leading to a denial of service (DoS) condition, rendering the lollms application unavailable to legitimate users. Furthermore, the ability to process arbitrary files could allow an attacker to disclose sensitive information contained within those files. The lack of authentication on this endpoint represents a significant security policy violation, as it circumvents intended access controls.

Organizations deploying lollms in production environments, particularly those without robust network segmentation or intrusion detection systems, are at significant risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as an attacker could potentially compromise the entire environment through this vulnerability.

• python / server:

import requests

url = 'http://your-lollms-server/api/files/extract-text'
files = {'file': open('test.txt', 'rb')}
response = requests.post(url, files=files)

if response.status_code == 200:
    print('Potential vulnerability: File upload successful without authentication.')
else:
    print('File upload failed.')

• linux / server:

journalctl -u lollms -f | grep "/api/files/extract-text"

• generic web:

curl -I http://your-lollms-server/api/files/extract-text

Check response headers for lack of authentication requirements.

1. 2026-03-29Disclosure

   disclosure

1. Gereserveerd2026-01-01
2. Gepubliceerd2026-03-29
3. Gewijzigd2026-03-30
4. EPSS bijgewerkt2026-04-06

The recommended mitigation for CVE-2026-0558 is to immediately upgrade lollms to version 2.2.0 or later, which includes the necessary authentication checks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /api/files/extract-text endpoint from unauthenticated users. Additionally, review and strengthen the application's overall authentication and authorization mechanisms. Monitor server logs for suspicious file upload activity, particularly requests originating from unknown or unauthorized sources.