cbcvebase.
CVE-2026-33340
published 2026-03-24

CVE-2026-33340: LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability…

PriorityP185critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EXPLOIT
EPSS
21.63%
97.3th percentile
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.

Affected

1 ranges
VendorProductVersion rangeFixed in
parisneolollms-webui<= 8c5dcef63d847bb3d027ec74915d8fe4afd3014e—

Detection & IOCsextracted from sources · hover to see the quote

url/api/proxy↗
commandPOST /api/proxy HTTP/1.1 Content-Type: application/json {"url": "http://{{interactsh-url}}"}↗
  • →Detect unauthenticated POST requests to the /api/proxy endpoint; the request body will contain a JSON 'url' key pointing to an attacker-controlled or internal resource. ↗
  • →Monitor for POST /api/proxy requests targeting cloud metadata endpoints (e.g., AWS/GCP IAM token URLs) to detect credential exfiltration attempts via SSRF. ↗
  • →No authentication is required to trigger the vulnerability; any POST to /api/proxy without credentials should be treated as suspicious. ↗
  • ·No patched version is available as of time of publication; all known existing versions of lollms-webui are affected. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.