CVE-2026-103243
5.8 MEDIUMpublic exploit availablePublished 2026-09-30 · Updated 2026-10-02
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-918
Public exploit & PoC references
- https://github.com/ModelTC/LightLLM
- https://github.com/ModelTC/LightLLM/issues/1608
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91
- https://github.com/ModelTC/LightLLM/issues/1608
All references
- https://github.com/ModelTC/LightLLM
- https://github.com/ModelTC/LightLLM/issues/1608
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91
- https://www.vulncheck.com/advisories/lightllm-through-1.2.0-server-side-request-forgery-via-multimodal-endpoints
- https://github.com/ModelTC/LightLLM/issues/1608
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2020-37278PoC
- HIGHCVE-2023-54402PoC
- MEDIUMCVE-2024-34319
- UNSCOREDCVE-2026-0311
- LOWCVE-2026-100104
- MEDIUMCVE-2026-100251
- MEDIUMCVE-2026-100257
- MEDIUMCVE-2026-100279
Related by shared AI tags and CWE weakness class. Browse the full archive.