CVE-2026-103243

5.8 Moyenne

Publiée le 30/09/2026 à 17:22 · Modifiée le 02/10/2026 à 19:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

Traduire en français

Produits concernés

ModelTC LightLLM

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.8 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/ModelTC/LightLLM
https://github.com/ModelTC/LightLLM/issues/1608
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91
https://www.vulncheck.com/advisories/lightllm-through-1.2.0-server-side-request-forgery-via-multimodal-endpoints
https://github.com/ModelTC/LightLLM/issues/1608

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories