The vulnerability in parisneo/lollms (up to version 2.2.0) stems from the /api/files/extract-text endpoint lacking the authentication dependency that other file-related endpoints enforce. This improper authentication (CWE-287) permits unauthenticated users to upload and process files, which can lead to denial of service via resource exhaustion and information disclosure. The CVSS 3.0 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory is currently provided.

Unauthenticated attackers can exploit this endpoint to upload and process files, potentially exhausting server resources and causing denial of service. Additionally, this may lead to unauthorized information disclosure and breaches of the application's security policies. No evidence of known exploits in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/files/extract-text endpoint through network controls or authentication proxies to prevent unauthenticated access. Monitor for unusual activity related to this endpoint.