The vulnerability is a server‑side request forgery that occurs in the /api/files/export-content endpoint of parisneo/lollms. The backend function _download_image_to_temp fails to validate user‑controlled URLs, which allows an attacker to instruct the server to make arbitrary HTTP requests. This can give the attacker internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution. The weakness is classified as CWE‑918.

The affected vendor is parisneo and the product is lollms. Versions earlier than 2.2.0 are vulnerable.

The CVSS score of 7.5 indicates a high severity. No EPSS value is available, and the vulnerability is not listed in the KEV catalog. Attackers can exploit the flaw by sending crafted requests to the vulnerable endpoint, typically from a web application or API that is accessible to them. Successful exploitation requires the server to have outbound network connectivity, which is common in deployed environments. Given the potential for remote code execution, the risk to affected installations is significant and warrants urgent attention.