CVE-2026-109166
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-639
Impact
Authenticated users can read arbitrary uploaded attachments and files across the tenant. Attackers only need valid login credentials and guessed or enumerated file IDs.
Root cause
The findUrlById endpoint in FileAnyoneController fails to verify that the requesting user owns the requested file ID before returning its storage URL.
Affected systems
lamp-cloud through 5.10.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to a version newer than 5.10.1 once released by the vendor; if patching has to wait, block access to the findUrlById endpoint or restrict FileAnyoneController routing at the API gateway or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.
References
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/lamp-cloud/poc_findUrlById_url.py
- https://github.com/dromara/lamp-cloud/blob/d61184d7d402023fc3ea63b6bdbd7a1bfdb8ce92/lamp-base/lamp-base-biz/src/main/java/top/tangyh/lamp/file/strategy/FileContext.java#L147-L170
- https://github.com/dromara/lamp-cloud/blob/d61184d7d402023fc3ea63b6bdbd7a1bfdb8ce92/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L75-L80
- https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.1-idor-via-anyone-file-findurlbyid