Description
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ModelTC | LightLLM | ≤ 1.2.0 | — |
References
- GitHub Issue #1608 issue-tracking
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91 technical-description
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149 technical-description
- https://github.com/ModelTC/LightLLM product
- VulnCheck Advisory: LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints third-party-advisory