CVE-2026-103243

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1

Description Multimodal endpoints fail to validate the image url and audio url parameters, enabling unauthenticated attackers to conduct server-side request forgery (SSRF). This occurs when attackers provide arbitrary URLs to fetch internal resources, which can lead to the disclosure of content via vision model processing or the revelation of internal network topology through error responses.

Recommendations Update to a version newer than 1.2.0. Restrict the use of the image url and audio url parameters in multimodal endpoints until the update is applied.