CVE-2026-103243 in LightLLM
الملخص
بحسب MITRE • 30/09/2026
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
VulDB is the best source for vulnerability data and more expert information about this specific topic.