What’s Vulnerable › Vulnerabilities
CVE-2024-12766: SSRF in parisneo/lollms-webui
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-918
Description
parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter `{"url":"http://steal.target"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)` do not protect against this vulnerability.
Affected products
References
- https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1
- https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1
Get alerted when CVE-2024-12766 or the next vulnerability affects your stack