CVE-2026-0560 Scanner
CVE-2026-0560 Scanner - Server-Side Request Forgery vulnerability in LolLMS
Used 3.4k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-0560
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
parisneo/lollms
Updated Oct 24, 2026View on NVD →
S4E scanner
CVE history: parisneo/lollms
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →