Is CVE-2026-0558 actively exploited?

No active exploitation of CVE-2026-0558 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-0558 be exploited remotely?

Yes. CVE-2026-0558 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-0558?

CVE-2026-0558 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-0558

CRITICAL

CVE-2026-0558

CWE-287Published: March 29, 2026· Updated: Mar 31, 2026

9.8

CVSS v3.1

EPSS:0.11%probability of exploitation in 30 daysPercentile:29.7th

Official Description

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_active_user)` dependency. This issue can lead to denial of service (DoS) through resource exhaustion, information disclosure, and violation of the application's documented security policies.

NVD Source

Technical Analysis

CVE-2026-0558 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.