CVE-2026-103243 — LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. A…
Published: 2026-09-30 · CVSS: 6.9 · CVSS 4.0
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7