Server-Side Request Forgery in LightLLM from ModelTC
CVE-2026-103243

6.9MEDIUM

Key Information:

Vendor

Modeltc

Status
Lightllm
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103243?

The vulnerability in LightLLM versions up to 1.2.0 arises from insufficient validation of the image_url and audio_url parameters in multimodal endpoints. This flaw allows unauthenticated attackers to perform server-side request forgery (SSRF), enabling them to submit arbitrary URLs. Consequently, attackers can compel the server to fetch internal resources, potentially disclosing sensitive internal content or yielding error messages that reveal the internal network architecture.

Affected Version(s)

LightLLM 0 <= 1.2.0

References

https://github.com/ModelTC/LightLLM/issues/1608
issue-tracking
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiapeng Li
Jiajia Liu
.