CVE-2026-10595

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 3

Description A path traversal issue exists in the SPA catch-all route implemented in backend/routers/ui.py. The flaw occurs because user-controlled path input is joined into a filesystem path without proper sanitization or containment checks. An unauthenticated attacker can use URL-encoded dot-dot sequences (%2e%2e) to bypass Starlette's path normalization, which are then resolved by Python's pathlib, enabling the reading of arbitrary files on the server.

Recommendations Update to version 3.