Multipart Boundary Vulnerability in parisneo/lollms-webui

CVE-2025-1451

Summary

A vulnerability exists in the parisneo/lollms-webui v13 related to the handling of multipart boundaries during file uploads. The server fails to impose restrictions on the length and contents of the boundary, permitting attackers to create requests with excessively long or specially crafted boundaries. While an attempt was made to mitigate this issue by blocking hyphen characters, the solution is inadequate, leaving the server still susceptible when other characters, such as '4' or 'a', are utilized. This oversight may result in resource exhaustion and result in denial of service, disrupting normal operations.

References