The vulnerability arises from the absence of validation on user‑provided URLs in the `/api/files/export-content` endpoint of parisneo/lollms. An attacker can provide a crafted URL to the internal `_download_image_to_temp` function, forcing the server to perform arbitrary HTTP requests. This can expose sensitive internal services, retrieve cloud instance metadata, conduct port scans, and in some cases lead to remote code execution on the host. The weakness correlates with the Server‑Side Request Forgery pattern (CWE‑918).

Parisneo’s lollms application, versions earlier than 2.2.0, is affected. The issue is present in the backend routers in the `files.py` module, specifically the `_download_image_to_temp` routine used by the `/api/files/export-content` API endpoint.

The CVSS v3 score of 7.5 reflects a high potential for impact. The EPSS score is 2%, indicating a low probability of public exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows attackers to drive outbound traffic from the vulnerable server, it can serve as a pivot to internal systems, making it a significant insider‑or‑remote threat. The typical attack vector is a remote HTTP request to the vulnerable endpoint, with the attacker controlling the target URL.