{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-02T07:04:21.856","vulnerabilities":[{"cve":{"id":"CVE-2026-10595","sourceIdentifier":"security@huntr.dev","published":"2026-08-09T04:17:29.400","lastModified":"2026-08-10T18:17:38.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are resolved by Python's `pathlib`, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"parisneo","product":"parisneo/lollms","versions":[{"version":"unspecified","lessThan":"3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-10T17:14:57.414907Z","id":"CVE-2026-10595","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]}],"references":[{"url":"https://github.com/parisneo/lollms/commit/9bc6431ae7b708da76d51e7626a7cf48ff2b1d24","source":"security@huntr.dev"},{"url":"https://huntr.com/bounties/af3f40a3-38a1-49d8-a5ae-3d72b9b05b98","source":"security@huntr.dev"},{"url":"https://huntr.com/bounties/af3f40a3-38a1-49d8-a5ae-3d72b9b05b98","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}]}