CloudMap 漏洞情报库

中危CVE-2026-541572026/06/25

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.

lobechatPoC 已收录

CVSS—

严重CVE-2024-329642024/05/15

Lobe Chat <= v0.150.5 - Server-Side Request Forgery

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

lobechatPoC 已收录

CVSS9.0EPSS 23.9%

lobechat

关联漏洞

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery

Lobe Chat <= v0.150.5 - Server-Side Request Forgery