CVE-2026-0558 Unauthenticated File Upload in parisneo/lollms

What is CVE-2026-0558?

CVE-2026-0558 is a high-severity missing authorization vulnerability in parisneo/lollms, published on 29 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.

Weakness: CWE-287

Which versions are affected by CVE-2026-0558?

1 open source package ship an affected version, including lollms. It affects 1 product.

Products include Lollms Lollms.

How do I fix CVE-2026-0558?

Upgrade lollms to 2.1.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-0558 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0558 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in parisneo/lollms

• CVE-2026-1114 Improper Access Control via Weak JWT Token in parisneo/lollms Critical 9.8
• CVE-2024-3429 Path Traversal in parisneo/lollms Critical 9.8
• CVE-2026-1115 Stored XSS in parisneo/lollms Critical 9.6
• CVE-2026-12228 Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms High 8.7
• CVE-2026-0562 Insecure Direct Object Reference (IDOR) in parisneo/lollms High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4574-jvgw-55gr, PYSEC-2026-2198.