Executive brief
SGLang, an open-source framework for serving Large Language Models (LLMs), contains a vulnerability in its image processing component. By providing a specially crafted image URL to the chat completion service, an attacker can force the server to read local files or access internal network services that are not intended to be public. This could lead to the exposure of sensitive system files, internal metadata, or credentials stored on the server.
Technical details
A Server-Side Request Forgery (SSRF) and local file disclosure vulnerability exists in SGLang's multimodal generation endpoint (/v1/chat/completions). The root cause is the lack of input validation and sanitization on the 'image_url' parameter within the multimodal media loading logic. An unauthenticated or low-privileged attacker (depending on the server's API key configuration) can provide a URL pointing to local file paths (e.g., file:///etc/passwd) or internal network resources (e.g., cloud metadata services at 169.254.169.254). This allows for the exfiltration of local files, internal service discovery, and potential disclosure of secrets or internal metadata. The vulnerability is present in versions up to and including v0.5.15.
Affected products
- SGLang Project SGLang <= v0.5.15
Timeline
- 2026-04-22: disclosed: Initial disclosure to maintainers via GitHub Security Advisories.
- 2026-07-30: advisory: Public disclosure via CERT/CC and researcher blog.