CVEs / CVE-2026-33340
CVE-2026-33340: ParisNeo lollms-webui vulnerability
- critical 9.1 CVSS 3.1 (from the CNA)
- EPSS 21.6% chance of exploitation in the next 30 days, higher than 97% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-33340
Description
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| ParisNeo lollms-webui | <= 8c5dcef63d847bb3d027ec74915d8fe4afd3014e | — |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.
Severity
| CVSS 3.1 | 9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-306, CWE-918 |
References
- CVE-2026-33340 on NVD
- CVE-2026-33340 on OSV
- https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450 Product
- https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4 Exploit, Mitigation, Vendor Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.