CVE-2025-61784
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
LLaMA-Factory before version 0.9.4 contains an SSRF vulnerability in the chat API that allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. The same mechanism also allows for Local File Inclusion (LFI), enabling reading arbitrary files from the server's filesystem. The issue is in the `_process_request` function in `src/llamafactory/api/chat.py`, which does not validate URLs.
Risk Assessment
An attacker can access sensitive internal services, perform reconnaissance of the internal network, or read confidential files from the server, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade LLaMA-Factory to version 0.9.4 or later, which fixes the issue. Additionally, restrict access to the chat API to trusted users only.
Other vulnerabilities in LLaMA-Factory
See all- CVE-2026-58116Critical
LLaMA-Factory through version 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.
- CVE-2026-85673High
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
Original NVD description (English source)
LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or interaction with third-party services. The same mechanism also allows for a Local File Inclusion (LFI) vulnerability, enabling users to read arbitrary files from the server's filesystem. The vulnerability exists in the `_process_request` function within `src/llamafactory/api/chat.py.` This function is responsible for processing incoming multimodal content, including images, videos, and audio provided via URLs. The function checks if the provided URL is a base64 data URI or a local file path (`os.path.isfile`). If neither is true, it falls back to treating the URL as a web URI and makes a direct HTTP GET request using `requests.get(url, stream=True).raw` without any validation or sanitization of the URL. Version 0.9.4 fixes the underlying issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS