CVE-2026-113358 in CMS
Summary
by MITRE • 10/20/2026
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The LavaLite CMS, specifically versions up to 10.1.2, suffers from a critical missing authentication vulnerability within its Filer module that exposes sensitive stored files to unauthenticated access. This flaw resides in the FileController class and affects two primary endpoints: filer/download and filer/display. These routes are intended to serve file content to authenticated users who have appropriate permissions for specific resources. However, due to a failure in implementing proper access control checks before processing requests, these endpoints can be accessed by any actor on the network without requiring valid session credentials or API tokens. This represents a fundamental breakdown in security architecture where public-facing interfaces inadvertently expose internal resource management logic that should remain restricted.
The technical nature of this vulnerability allows attackers to manipulate input parameters related to disk names and file paths. By supplying arbitrary values for these parameters, an attacker can bypass intended directory restrictions and traverse the underlying storage system. The application fails to validate whether the requesting user has ownership or permission rights over the specific file being requested. Consequently, it is possible to retrieve private uploads that were stored in local server directories as well as files hosted on configured remote Amazon S3 buckets. This capability effectively turns the CMS into a tool for data exfiltration, allowing adversaries to read confidential documents, images, and other assets that are not meant for public consumption.
From an operational impact perspective, this vulnerability poses severe risks to organizations relying on LavaLite CMS for content management or application hosting. The ability to download arbitrary files can lead to the exposure of personally identifiable information (PII), proprietary business data, configuration files containing database credentials, and other sensitive materials. If private uploads include user-generated content with embedded metadata or if they contain administrative backups, the breach could facilitate further attacks such as credential stuffing, social engineering, or deeper system compromise. The lack of authentication requirement means that automated scanning tools can easily discover and exploit this weakness across large numbers of instances without needing to first bypass login mechanisms.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically where the software does not sufficiently establish the identity of a user before granting access to resources. It also relates to CWE-538, Insertion of Sensitive Information into Externally-Accessible File or Directory, as private files are made accessible through external routes without proper safeguards. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1005, Data from Local System Retrieval, where an adversary accesses data directly from the local system without executing malware. The exploitation path involves navigating file systems and accessing stored objects, which is a common precursor to more advanced lateral movement or persistence strategies in real-world attack scenarios.
Mitigation for this vulnerability requires immediate patching of the LavaLite CMS installation to version 10.1.3 or later, where these authentication checks have been properly implemented within the FileController logic. Administrators should verify that all instances are updated and monitor logs for unusual access patterns to the filer/download and filer/display endpoints prior to applying patches. In environments where immediate patching is not feasible, network-level controls such as web application firewalls can be configured to restrict access to these specific routes based on IP reputation or behavioral anomalies. Additionally, organizations should conduct a thorough audit of their file storage permissions to ensure that no sensitive data remains in publicly accessible directories and consider implementing additional encryption for stored files at rest to reduce the impact if future vulnerabilities arise.