This vulnerability allows anyone on the network to send requests to the "/api/files/extract-text" endpoint and upload arbitrary files without needing credentials. Because the endpoint does not enforce authentication and lacks proper request size or resource limits, an attacker can upload large or malicious files that consume CPU or memory, leading to resource exhaustion and a denial of service. The ability to process files also potentially exposes sensitive data contained in the uploaded files or in the service’s internal processing logs, violating the application’s documented security policies.

The issue affects the open‑source project parisneo/lollms, specifically versions up to and including 2.2.0. Any deployment of this version that exposes the /api/files/extract-text endpoint to unauthenticated users is vulnerable.

With a CVSS base score of 7.5, the vulnerability is considered high severity. No EPSS data is available and it is not currently listed in the CISA KEV catalog, but the lack of authentication makes exploitation trivial to anyone who can reach the endpoint. An attacker can simply craft large files or repeated requests to trigger a DoS, and the endpoint’s open processing may also reveal internal information. The likelihood of exploitation is high due to the obvious lack of access control.