Which products and versions are affected by CVE-2026-1115?

Affected: Lollms; parisneo/lollms versions >= unspecified. The full list is in the CVE brief.

Is CVE-2026-1115 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2026-1115 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-1115?

Public exploit code is available.

Is there a fix for CVE-2026-1115?

Fixed versions are available, including Lollms 2.2.0, Lollms 2.1.0, parisneo/lollms 2.2.0.

How urgently should CVE-2026-1115 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

Vulnerability Intelligence

CVE-2026-1115

CriticalPublic exploit

parisneo/lollms vulnerable to stored XSS in the social feature

Published Apr 10, 2026 · Updated Aug 29, 2026 · Also known as GHSA-8wrq-fv5f-pfp2, PYSEC-2026-401

Key Facts

Patch immediately

CVE-2026-1115 is a critical-severity vulnerability (CVSS 9.6 v3.1) affecting Lollms, parisneo/lollms.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 1.3% probability of exploitation in the next 30 days.
Fixed versions are available, including Lollms 2.2.0, Lollms 2.1.0, parisneo/lollms 2.2.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

CVSS v3.1

9.6

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

1.3%

Higher than 69.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-1115 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the create_post function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without sanitization. This allows attackers to inject and store malicious JavaScript, which is executed in the browsers of users viewing the Home Feed, including administrators. This can lead to account takeover, session hijacking, and wormable attacks. The issue is resolved in version 2.2.0.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
LollmsLollms	See advisory	2.1.0
parisneo/lollms	>= unspecified	2.2.0

Patched Releases

Lollms

2.2.0, 2.1.0

parisneo/lollms

2.2.0

Timeline

Publicly disclosed
Apr 10, 2026
Last updated
Aug 29, 2026

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

2 more references in the full CVE brief

FAQ

Common Questions.

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0.
Affected: Lollms; parisneo/lollms versions >= unspecified. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Lollms 2.2.0, Lollms 2.1.0, parisneo/lollms 2.2.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2026-1115 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.