CVE Intelligence
Analysis AI-assisted

CVE-2026-0558: Unauthenticated File Upload in parisneo/lollms

CVE-2026-0558 affects parisneo/lollms and allows unauthenticated users to submit files to a text extraction endpoint that lacks the authentication check used by other file-related endpoints. The NVD rates it 9.8 (critical) under CVSS 3.1, and the associated weakness is CWE-287 Improper Authentication. No confirmed exploitation appears in the sources consulted, and the CISA KEV catalog does not list it.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0558 is an improper authentication issue in parisneo/lollms. According to the record, the text extraction endpoint at /api/files/extract-text processes uploaded files for unauthenticated users, while other file-related endpoints in the application require an authenticated active user. The CNA is @huntr_ai, and the record was published on 2026-03-29.

Impact

  • Denial of service through resource exhaustion, as described in the record.
  • Possible information disclosure.
  • Violation of the application's documented security policies.

The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network access, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The sources do not explain how the described DoS, disclosure and policy effects map onto those vector components.

Affected products and versions

  • Lollms Lollms: 2.1.0 and earlier, per the affected-product field of the record.
  • Parisneo Parisneo/lollms: before 2.2.0, per the affected-product field of the record.
  • The description states the issue applies up to and including 2.2.0. This conflicts with the affected-product field, and the record does not resolve it.
  • A patch commit is referenced in the record. The record does not name a specific fixed release, so the exact first fixed version is unknown.

Exploitation status

  • The CISA KEV catalog does not list this CVE. No confirmed active exploitation appears in the sources consulted.
  • The SSVC data in the record lists exploitation as 'poc', indicating a proof-of-concept condition, not observed attacks.
  • One reference is tagged as Exploit in the record, which indicates exploit-related material exists in the bounty tracker.
  • The EPSS probability is 0.02047 with a percentile of 0.81066, as recorded.

Remediation and mitigation

  • Apply the patch commit referenced in the record, or move to a release that includes it. Confirm the fixed release against the maintainer's release notes, since the record does not name one.
  • Until patched, restrict network access to lollms instances so that only trusted networks can reach the application, and place it behind an authenticated gateway.
  • Treat the 2.2.0 boundary as uncertain: assume systems at 2.2.0 may be affected until verified.

Detection guidance

  • Review web server and application logs for requests to the file text extraction endpoint that lack an authenticated session.
  • Monitor CPU, memory and disk usage on hosts running lollms for unusual sustained spikes that coincide with file-processing activity.
  • Track upload volume and frequency on file processing routes and alert on abnormal patterns.

Limitations of the available information

  • The record conflicts on whether version 2.2.0 is affected.
  • The record does not name a specific fixed release.
  • The record does not provide a detailed technical analysis of the code path.
  • The EPSS date is recorded as 2026-10-23, which is not explained by the record.
  • Only the NVD and CVE Program pages, the patch commit and the huntr bounty page were available as sources.

Frequently asked questions

Is CVE-2026-0558 being exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record does show an SSVC exploitation status of proof-of-concept and a reference tagged as Exploit.

Which versions are affected?

The affected-product field lists 2.1.0 and earlier for Lollms and before 2.2.0 for Parisneo/lollms, while the description says up to and including 2.2.0. The sources conflict on whether 2.2.0 is affected.

What should administrators do now?

Apply the patch commit referenced in the record or a release that includes it, and restrict network access to lollms instances until the fix is in place. Verify the fixed release, because the record does not name one.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.