CVE-2026-10595: Path Traversal Vulnerability in parisneo/lollms
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (%2e%2e) bypass Starlette's built-in path normalization and are resolved by Python's pathlib, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
parisneo/lollmsto a version that resolves this vulnerability.Fixed in 3 - Compensating control
Ensure the SPA catch-all route in backend/routers/ui.py contains the resolved filesystem path within an intended base directory (containment check) and rejects/normalizes URL-encoded dot-dot sequences (e.g., %2e%2e) used to bypass Starlette path normalization.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10595?
The severity of CVE-2026-10595 is high, with a CVSS score of 7.5.
How do I fix CVE-2026-10595?
To fix CVE-2026-10595, update to the latest version of parisneo/lollms that addresses the path traversal vulnerability.
What systems are affected by CVE-2026-10595?
CVE-2026-10595 affects parisneo/lollms version 2.1.0 due to improper handling of user-controlled path input.
What type of vulnerability is CVE-2026-10595?
CVE-2026-10595 is a path traversal vulnerability.
What are the potential impacts of exploiting CVE-2026-10595?
Exploiting CVE-2026-10595 could allow an attacker to access sensitive files on the file system.