CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint.
Published Mar 29, 2026 · updated Jun 17, 2026 · lollms lollms
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 29, 2026 · NIST NVD
Detected
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's docum
Jun 17, 2026 · NIST NVD
Updated
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's docum
Affected
- cpe lollms/lollmsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-0558
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depen
nvd.nist.gov