S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Aug 20, 2026

CVE-2026-0558 Scanner

CVE-2026-0558 Scanner - Unauthenticated File Upload vulnerability in LolLMS

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2.6k
Times Used
continuous scan runs
6k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-0558
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
parisneo/lollmsby parisneo
AFFECTED< 2.2.0SAFE ✓≥ 2.2.0
Updated Sep 9, 2026View on NVD →
Detail

LolLMS is an educational platform that facilitates the creation and management of online learning modules. It is utilized by educational institutions, private organizations, and individual educators to deliver courses online. The platform provides tools for content creation, student assessment, and interactive learning. Educational institutions deploy LolLMS to provide seamless learning experiences to students worldwide. The system is generally hosted on web servers, making it easily accessible over the internet. Its rich set of features makes it a popular choice among educators looking to leverage technology for learning.

The Unauthenticated File Upload vulnerability in LolLMS arises from insufficient access control in certain file processing endpoints. This vulnerability allows unauthorized users to upload files through the /api/files/extract-text endpoint without verifying their identity. Such a flaw can lead to various security issues, including information disclosure and denial of service attacks. Malicious attackers can exploit this weakness to bypass security controls intended to protect sensitive information within the application. It is a critical flaw that requires immediate attention to prevent potential cybersecurity threats. Proper access control mechanisms should be implemented to mitigate this risk.

The vulnerability in LolLMS is located in the /api/files/extract-text endpoint, where a lack of proper authentication mechanisms allows unauthenticated file uploads. The endpoint does not incorporate the Depends(get_current_active_user) dependency, which is normally used in other file-related APIs to ensure that only authorized users can perform such actions. By exploiting this vulnerability, an attacker could send crafted HTTP POST requests to this endpoint, supplying files that could be processed and executed by the server. The absence of authentication checks poses a significant risk of unauthorized access to the system.

When exploited, this vulnerability can have severe consequences, including unauthorized file processing and potential manipulation of server-side resources. Attackers might gain access to sensitive information or disrupt services by exhausting server resources through file uploads. The risk of bypassing intended access controls also increases, potentially leading to exposure of confidential data. Furthermore, the successful exploitation of this vulnerability can undermine the integrity and availability of the educational services provided by LolLMS.

REFERENCES

Solution Advice
  • Update to a patched version containing commit a6625dc83786ff21d109b0d545ca61b770607ef3 or later.
  • Restrict unauthenticated access to /api/files/extract-text until the update is applied.
  • Implement access control mechanisms to ensure only authenticated users can upload files.
  • Regularly monitor and audit file uploads for any suspicious activity.
  • Provide user training and awareness about the risks of vulnerable endpoints.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

CVE-2026-0558 Scanner - Unauthenticated File Upload vulnerability in LolLMS | S4E