CVE-2026-103243
Deferred Deferred - Pending Action

Server-Side Request Forgery in LightLLM

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103243
EUVD
EUVD-2026-89988

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
modeltc lightllm to 1.2.0 (inc)
lightllm lightllm to 1.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LightLLM through version 1.2.0 has a Server-Side Request Forgery (SSRF) vulnerability in its multimodal endpoints. The flaw allows unauthenticated attackers to manipulate image_url and audio_url parameters to send arbitrary requests to internal resources. The server fails to validate these URLs properly, enabling attackers to fetch internal content or trigger error responses that reveal internal network details.

Detection Guidance

To detect this SSRF vulnerability in LightLLM, monitor network traffic for outbound requests to internal IP ranges or unusual URLs from the LightLLM server process. Check logs for error messages indicating failed fetches of internal resources or distinct responses revealing internal network topology. Use tools like tcpdump or Wireshark to capture outbound connections from the LightLLM process.

Impact Analysis

This vulnerability can lead to confidentiality breaches where internal resources are exposed. Attackers may read sensitive internal data or probe internal network ports and paths. Error messages from failed requests could reveal internal network topology. Additionally, improper handling of large or malformed files may cause resource exhaustion or crashes.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and confidentiality. GDPR mandates protection of personal data, and HIPAA requires safeguarding protected health information. Exposure of internal resources or network details could result in non-compliance, potential fines, and reputational damage due to unauthorized data access.

Mitigation Strategies

Immediately upgrade LightLLM to a patched version if available. If not, implement strict URL validation by allowing only trusted domains and blocking private/internal IP ranges in image_url and audio_url parameters. Disable caching of fetched resources and avoid exposing detailed error messages from internal fetches. Restrict outbound network access from the LightLLM server to prevent SSRF.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart