CVE-2026-113358
7.5HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can download arbitrary stored files and private uploads from local storage or configured S3 disks. All they need is network access to the web server.
Root cause
The Filer module's FileController fails to enforce authentication or path restrictions on the filer/download and filer/display routes.
Affected systems
LavaLite CMS through 10.1.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No fixed version is currently listed; block external access to the /filer/download and /filer/display routes at your reverse proxy or web application firewall immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
References
- https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0
- https://github.com/LavaLite/cms/releases/tag/v10.1.2
- https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/Http/Controllers/FileController.php
- https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/routes/web.php
- https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-missing-authentication-via-filer-download-routes