CVE-2026-10595 is a path traversal vulnerability in lollms arising from a mismatch between how Starlette normalizes URL paths at the routing layer and how pathlib resolves those paths during filesystem operations. When a catch-all SPA route receives a path like /..%2f..%2fetc/passwd, Starlette's normalization passes it through largely untouched because it operates on a different abstraction layer than the filesystem join. The subsequent code uses pathlib to construct the filesystem path, which independently resolves URL-encoded sequences—so the %2f becomes / and the traversal executes. This is not a hidden interaction; pathlib's behavior is documented. The vulnerability exists because the developer treated the framework's path normalization as a security boundary when it was merely a routing convenience. The SPA catch-all pattern amplifies this: it's added as a convenience for client-side routing without treating it as a filesystem endpoint requiring containment logic. To verify you're affected, check whether any route handlers in your lollms deployment join user-supplied paths to filesystem operations using pathlib or similar constructs—specifically look for Path(path_variable).join() or equivalent patterns in route callbacks. The fix in version 3 adds containment checks (validating that the resolved path stays within the intended directory). Until you can upgrade, audit every route that serves files using path parameters and validate that resolved paths cannot escape the intended root using either canonical path comparison or explicit allowlist patterns. The AI platform context matters significantly here—lollms has access to model weights, training data, and API credentials, so a file read vulnerability potentially exposes your core intellectual property, not just system configuration. This changes the priority from 'routine path traversal' to 'critical exposure' regardless of the generic CVSS 7.5 score.
CVE-2026-10595
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are resolved by Python's `pathlib`, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysisA detailed technical summary for this CVE is being prepared.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedlollms version 3.x (any 3.x release)
- Check the currently installed version of lollms using: pip show lollms or pip list
- Upgrade to version 3.x by running: pip install lollms>=3.0.0 or pip install --upgrade lollms
- Verify the upgrade was successful by checking the installed version: pip show lollms
- Restart the lollms service to ensure the updated code is loaded
Generated from the published advisory — verify against the referenced sources before acting.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-10595 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesCVE-2026-10595 is a path traversal vulnerability in lollms arising from a mismatch between how Starlette normalizes URL paths at the routing layer and how pathlib resolves those paths during filesystem operations. When a catch-all SPA route receives a path like `/..%2f..%2fetc/passwd`, Starlette's normalization passes it through largely untouched because it operates on a different abstraction layer than the filesystem join. The subsequent code uses pathlib to construct the filesystem path, which independently resolves URL-encoded sequences—so the `%2f` becomes `/` and the traversal executes. This is not a hidden interaction; pathlib's behavior is documented. The vulnerability exists because the developer treated the framework's path normalization as a security boundary when it was merely a routing convenience. The SPA catch-all pattern amplifies this: it's added as a convenience for client-side routing without treating it as a filesystem endpoint requiring containment logic. To verify you're affected, check whether any route handlers in your lollms deployment join user-supplied paths to filesystem operations using pathlib or similar constructs—specifically look for `Path(path_variable).join()` or equivalent patterns in route callbacks. The fix in version 3 adds containment checks (validating that the resolved path stays within the intended directory). Until you can upgrade, audit every route that serves files using path parameters and validate that resolved paths cannot escape the intended root using either canonical path comparison or explicit allowlist patterns. The AI platform context matters significantly here—lollms has access to model weights, training data, and API credentials, so a file read vulnerability potentially exposes your core intellectual property, not just system configuration. This changes the priority from 'routine path traversal' to 'critical exposure' regardless of the generic CVSS 7.5 score.
Practitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-10595 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data