Server-Side Request Forgery Vulnerability in Parisneo Lollms Product

CVE-2026-0560

What is CVE-2026-0560?

An SSRF vulnerability exists in the Parisneo Lollms application affecting versions before 2.2.0. It is found in the /api/files/export-content endpoint, where the _download_image_to_temp() function neglects to validate user-supplied URLs. This oversight allows attackers to conduct unauthorized HTTP requests to internal services and cloud metadata endpoints. The security flaw can result in perilous scenarios, including unauthorized access to internal networks, exposure of sensitive cloud metadata, potential information disclosure, port scanning activities, and may even lead to remote code execution if exploited effectively.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References