CVE-2026-103243CWE-918ssrf

CVE-2026-103243

Medium · published September 30, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-30T19:22Z
References (6)
https://github.com/ModelTC/LightLLM · [email protected]https://github.com/ModelTC/LightLLM/issues/1608 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91 · [email protected]https://www.vulncheck.com/advisories/lightllm-through-1.2.0-server-side-request-forgery-via-multimodal-endpoints · [email protected]https://github.com/ModelTC/LightLLM/issues/1608 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 14:48Z
    LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
    cvelistv5