Unauthenticated File Download in LavaLite CMS

Executive Summary

CVE-2026-113358 is a missing authentication vulnerability in LavaLite CMS version 10.1.2 or earlier. It exists in the Filer module, which allows unauthenticated attackers to download stored files by exploiting the filer/download and filer/display routes. Attackers can supply arbitrary disk names and file paths to retrieve private uploads from local storage or remote S3 disks without any authentication checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the filer/download and filer/display routes by monitoring web server logs for requests to /filer/download/{disk}/{path?} and /filer/display/{disk}/{path?} without valid authentication tokens.

Use curl to test if the routes are accessible without authentication: curl -v http://<target>/filer/download/local/path/to/file or curl -v http://<target>/filer/display/local/path/to/file. If the server responds with file content, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive files stored in the CMS without authentication. Depending on the deployment, attackers could download private uploads, configuration files, or other sensitive data stored on local disks or S3 storage. This could lead to data breaches, unauthorized access to confidential information, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations. Unauthorized access to personal or sensitive data may result in violations of confidentiality requirements, leading to legal penalties, fines, or reputational damage. Organizations must ensure proper access controls to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update LavaLite CMS to the latest version beyond 10.1.2 if available, as the vulnerability affects versions up to and including 10.1.2.

Apply authentication middleware to the filer/download and filer/display routes to ensure only authorized users can access file operations.

Restrict access to the FileController methods by validating user input for disk and path parameters to prevent directory traversal attacks.

Useful 0 Not Useful 0