CVE-2026-113358 Details
Description
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
A missing authentication vulnerability has been identified in the Filer module of LavaLite CMS versions through 10.1.2. This vulnerability allows unauthenticated attackers to download stored files via the filer/download and filer/display routes. Attackers can manipulate disk names and paths to the FileController, potentially accessing private uploads from local storage or remote S3 disks. The issue arises because the affected routes lack authentication and authorization checks, exposing sensitive data depending on the application's file storage configuration.
Implement authentication and authorization checks for the file download and display routes in the Filer module. Ensure that requested paths are validated against the user's permissions and the configured filesystem disk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LavaLite CMS | <= 10.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |