Which products and versions are affected by CVE-2026-0558?

Affected: Lollms; parisneo/lollms versions >= unspecified. The full list is in the CVE brief.

Is CVE-2026-0558 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2026-0558 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-0558?

Public exploit code is available.

Is there a fix for CVE-2026-0558?

Fixed versions are available, including Lollms 2.1.1, Lollms 2.1.0, parisneo/lollms 2.2.0.

How urgently should CVE-2026-0558 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

Vulnerability Intelligence

CVE-2026-0558

CriticalPublic exploit

Unauthenticated File Upload in parisneo/lollms

Published Mar 29, 2026 · Updated Aug 29, 2026 · Also known as PYSEC-2026-2198

Key Facts

Patch immediately

CVE-2026-0558 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Lollms, parisneo/lollms.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 2.0% probability of exploitation in the next 30 days.
Fixed versions are available, including Lollms 2.1.1, Lollms 2.1.0, parisneo/lollms 2.2.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

2.0%

Higher than 80.8% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-0558 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the Depends(get_current_active_user) dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
LollmsLollms	See advisory	2.1.0
parisneo/lollms	>= unspecified	2.2.0

Patched Releases

Lollms

2.1.1, 2.1.0

parisneo/lollms

2.2.0

Timeline

Publicly disclosed
Mar 29, 2026
Last updated
Aug 29, 2026

Weakness Type

CWE-287 Improper Authentication

References

FAQ

Common Questions.

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint.
Affected: Lollms; parisneo/lollms versions >= unspecified. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Lollms 2.1.1, Lollms 2.1.0, parisneo/lollms 2.2.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2026-0558 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.