CVE-2026-113358: LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
Published Oct 20, 2026
·Updated
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Affected Software
1 affected component
Lavalite LavaLite CMS<=10.1.2
Event History
Oct 20, 2026
CVE Published
via MITRE·10:41 AM
Data Sourced
via MITRE·10:41 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploiting this issue require an account or user interaction?
No. The vulnerability is remotely exploitable without authentication or user interaction, using the filer/download or filer/display routes.
2
What data could be exposed?
An attacker can retrieve stored files by supplying disk names and paths to FileController. This includes private uploads on local storage and on configured remote S3 disks.