Path Traversal in LOLLMS SPA Route Handler

CVE-2026-10595 is a path traversal vulnerability in parisneo/lollms version 2.1.0 that allows unauthenticated attackers to read arbitrary files from the server filesystem. The vulnerability exists in the SPA catch-all route within `backend/routers/ui.py`, where user-controlled path input is directly concatenated into filesystem paths without proper sanitization or containment verification. The attack exploits URL-encoded dot-dot sequences (`%2e%2e`) that bypass Starlette's path normalization, allowing attackers to navigate directory structures and access sensitive files. This affects any organization running vulnerable versions of LOLLMS, particularly those exposing the application to untrusted networks. With a CVSS score of 7.5 (high severity), the vulnerability presents significant risk for information disclosure, including potential access to configuration files, credentials, and other sensitive data stored on the server.

While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's 754 security skills—powered by Claude AI's extended reasoning capabilities—would identify this vulnerability through reconnaissance and exploitation pattern detection. Practitioners using Casky would observe attack indicators associated with Reconnaissance (T1592: Gather Victim Host Information) and Execution (T1059: Command Line Interface) patterns, as attackers probe directory structures and attempt path traversal sequences. The platform's skills would flag suspicious HTTP requests containing URL-encoded traversal characters, abnormal file access patterns, and attempts to reach directories outside intended application scope. Security teams would see detailed findings highlighting the improper input validation, lack of path containment checks, and the specific bypass mechanism using percent-encoding—enabling them to prioritize patching, implement WAF rules to block encoded dot-dot sequences, and deploy file access controls to limit exposure.