CVE-2026-85673

HighCVSS 7.5

Published: 04/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.

Risk Assessment

The risk includes unauthorized access to internal network resources and potential disclosure of sensitive data from cloud metadata.

Recommendation

Implement re-validation of URLs after redirects and DNS resolution, and restrict access to internal IP addresses.

Other vulnerabilities in LLaMA-Factory

CVE-2026-58116Critical
LLaMA-Factory through version 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS