What is CVE-2026-0560?

CVE-2026-0560 is a high-severity vulnerability in Lollms, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2026-03-29.

How severe is CVE-2026-0560?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2026-0560 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Lollms

CVE-2026-0560

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.018 (75.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lollms
Parisneo Parisneo/lollms — versions unspecified

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

Max78000/CVE-2026-0560-lollms

References

security@huntr.dev (Exploit, Third Party Advisory, Issue Tracking)
security@huntr.dev (Patch)

Frequently asked questions

What is CVE-2026-0560?: CVE-2026-0560 is a high-severity vulnerability in Lollms, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2026-03-29.
How severe is CVE-2026-0560?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2026-0560 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.