CVE-2026-0560
1 advisory.
PyPI/lollms CVE-2026-0560: high 7.5
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function
Action: Upgrade lollms to 2.1.1 or later.
pip install lollms==2.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.1 | - |
Fixed versions
| 2.1.1 |
Sources
- osv: PYSEC-2026-2199
- https://huntr.com/bounties/65e43a5e-b902-4369-b738-1825285a3ea5
- https://github.com/parisneo/lollms/commit/76a54f0df2df8a5b254aa627d487b5dc939a0263
CVE-2026-0560 · published · modified · JSON