---
id: CVE-2026-0558
aliases:
  - PYSEC-2026-2198
title: >-
  A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows
  unauthenticated users to upload and process files through t…
summary: >-
  A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows
  unauthenticated users to upload and process files through the
  `/api/files/extract-text` endpoint. This endpoint does not enforce
  authentication, unlike other f…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: lollms
product: lollms
ecosystem: pip
affected:
  - lollms < 2.1.1
patched:
  - lollms 2.1.1
published: '2026-03-29'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-2198'
references:
  - url: 'https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113'
  - url: >-
      https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02047
epssPercentile: 0.80359
ingestedAt: '2026-07-13T18:58:07.992Z'
exploits:
  nuclei:
    - CVE-2026-0558
  checkedAt: '2026-09-25T08:20:48.734Z'
exploitAvailable: true
---

## Overview

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.

## Affected packages

- `lollms < 2.1.1`

## Remediation

Upgrade to a patched release:

- `lollms 2.1.1`