CVE-2026-94533: lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the createdby column.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated lamp-cloud user can exploit it. The attacker needs valid attachment identifiers for files stored by other users.
Which endpoints are affected?
The affected endpoints are /anyone/file/down and /anyone/file/download. They allow downloads without validating that the requesting user owns the attachment.
What data is exposed?
Other users' stored attachments may be downloaded. The issue affects confidentiality; the provided data does not indicate file modification or service availability impact.