CVE-2026-0558 is a critical (CVSS 9.8) missing authentication flaw in parisneo/lollms through version 2.2.0. The /api/files/extract-text endpoint accepts and processes files from unauthenticated users, which can cause resource exhaustion and data exposure. A fix commit is linked, so update to a build that includes it.
What's affected
parisneo/lollms up to and including version 2.2.0, per the record. The record links a fix commit (a6625dc) in the project repository. It names no release number, so check the project releases for the first version that contains that commit.
How to check if you're exposed
pip show lollms
For a source checkout, run git log and look for commit a6625dc. Also check whether the server is reachable from the internet, and whether other file endpoints are protected by login.
What to do now
- Update to a version that contains commit a6625dc, or pull the repository at or after it.
- Until then, keep the server on a private network or behind a proxy that requires authentication.
- Limit upload sizes and processing time at the proxy.
- Check the process for unusual CPU, memory and disk use.
- Review logs for file uploads from unknown clients.
Open source AI front ends often grow quickly, and endpoint by endpoint authentication is easy to get wrong. A better design applies a default deny rule to the whole API, and then lists the few public routes on purpose. When you review a tool like this before use, check how many routes skip authentication.
Resource exhaustion deserves its own control. File processing can be costly, so put a limit on upload size, request rate and processing time at the proxy, whatever the application does. These limits help in many other incidents as well.
If you run the tool for a small team, put it behind a VPN or an identity aware proxy, so that it is not reachable by people who should not use it at all.
Why it matters
The record tags CWE-287 (improper authentication). The description is specific: other file endpoints use a dependency that requires an active user, and this one does not. The fix pattern is simple, apply the same dependency everywhere. The impact is resource exhaustion because file processing is costly, plus exposure of text extracted from files and a break of the stated security policy.
The record does not mark it as exploited, and it is not in the CISA KEV list. It is a good example of why every route needs a default deny rule, instead of per route checks that can be forgotten.
Quick check
What was missing?
The endpoint lacked the authentication dependency that other file endpoints use.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
- https://github.com/parisneo/lollms/commit/a6625dc83786ff21d109b0d545ca61b770607ef3
- https://huntr.com/bounties/0a722001-89ce-4c91-b6a6-a55ee5ba2113
Last reviewed: 19 October 2026.
