{"id":"CVE-2026-0558","aliases":["PYSEC-2026-2198"],"title":"A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through t…","summary":"A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other f…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"lollms","product":"lollms","ecosystem":"pip","affected":["lollms < 2.1.1"],"patched":["lollms 2.1.1"],"published":"2026-03-29","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2198","references":[{"url":"https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113"},{"url":"https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3"}],"tags":["osv","pip","exploit-available"],"epss":0.01936,"epssPercentile":0.78922,"ingestedAt":"2026-07-13T18:58:07.992Z","exploits":{"nuclei":["CVE-2026-0558"],"checkedAt":"2026-09-21T15:27:49.755Z"},"exploitAvailable":true,"slug":"CVE-2026-0558","body":"## Overview\n\nA vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.\n\n## Affected packages\n\n- `lollms < 2.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `lollms 2.1.1`","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4922,"id":"CVE-2026-0558","ts":1788887216227,"field":"exploit_available","old":"false","new":"true"},{"seq":3805,"id":"CVE-2026-0558","ts":1788886338001,"field":"exploit_available","old":"true","new":"false"},{"seq":2645,"id":"CVE-2026-0558","ts":1788883013991,"field":"exploit_available","old":"false","new":"true"},{"seq":1674,"id":"CVE-2026-0558","ts":1788882418250,"field":"exploit_available","old":"true","new":"false"},{"seq":782,"id":"CVE-2026-0558","ts":1788881851819,"field":"exploit_available","old":"false","new":"true"}]}