An unauthenticated vulnerability exists in the file extraction endpoint of the Parisneo/Lollms application. The /api/files/extract-text route allows any remote user to upload and process files without the required authentication dependency, enabling arbitrary file handling. This flaw can lead to resource exhaustion, causing a denial of service, and may expose sensitive content from uploaded files, thereby violating the application's intended security posture.

The issue affects the Parisneo/Lollms product up to and including version 2.2.0. Environment configurations that expose the vulnerable endpoint without additional controls are directly at risk.

The vulnerability has a CVSS score of 9.8, denoting critical severity. Although the EPSS score is below 1%, indicating a low current exploitation probability, once discovered it could be leveraged easily through standard HTTP requests without any authentication. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is over the network to the exposed API endpoint.