CVE-2026-113358 — LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/…
Published: 2026-10-20 · CVSS: 8.7 · CVSS 4.0
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7