Path Traversal Vulnerability in Parisneo Lollms Affects User Security

CVE-2026-10595

What is CVE-2026-10595?

A path traversal vulnerability exists in the Parisneo Lollms application, particularly in version 2.1.0. Due to improper management of user-controlled path inputs in the SPA catch-all route, an attacker could exploit this flaw to access files outside the intended directory. The exploitation involves the use of URL-encoded dot-dot sequences, which evade the default path normalization defenses provided by Starlette and are processed by Python's pathlib. This allows unauthorized users to read sensitive files on the server, which could lead to significant security breaches. Fortunately, this issue has been remedied in version 3 of the product.

References