A critical vulnerability in the LLaMA-Factory chat API allows authenticated attackers to perform Server-Side Request Forgery and Local File Inclusion, potentially leading to unauthorized data exposure.

The _process_request function in src/llamafactory/api/chat.py fails to validate URLs provided for multimodal content, allowing any authenticated user to trigger arbitrary HTTP requests or read arbitrary files from the server filesystem.

Successful exploitation of this flaw could result in the compromise of sensitive internal data, unauthorized access to internal network resources, and potential exfiltration of configuration files or credentials. With a CVSS score of 7.6, this vulnerability represents a high risk to organizational security, particularly for environments where the tuning library is exposed to untrusted or compromised user accounts.

Immediate Action: Upgrade LLaMA-Factory to version 0.9.4 or later immediately to incorporate the required URL validation logic.

Proactive Monitoring: Review application logs for unusual GET requests originating from the chat API, particularly those targeting internal IP addresses or local file paths.

Compensating Controls: Implement strict network egress filtering on servers running LLaMA-Factory to prevent unauthorized communication with internal services or restricted external endpoints.

Public Exploit Available: Unknown

Given the potential for both SSRF and LFI, this vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Administrators must prioritize updating to version 0.9.4 to neutralize the underlying flaw in the _process_request function. Immediate patching is the most effective way to prevent potential lateral movement or data theft.