CVE-2026-123818

Name of the Vulnerable Software and Affected Versions LMDeploy versions 0.12.3 through 0.14.x

Description A logical flaw exists in the URL validation process that allows for Server-Side Request Forgery (SSRF). The is safe url() function uses urlparse to validate remote media URLs, while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a specially crafted URL containing a backslash that causes urlparse to identify a globally routable hostname, while the actual request is routed to an internal host. This discrepancy allows attackers to bypass non-global address checks and induce applications to access internal HTTP services, potentially exposing sensitive data.

Recommendations Update to version 0.15.0.