{"id":"CVE-2026-113358","kind":"vulnerability","aliases":["CVE-2026-113358"],"related":[],"title":"LavaLite CMS: unauthenticated download of private uploaded files","description":"LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.","summary":"LavaLite CMS <= 10.1.2: the Filer module registers GET /filer/download/{disk}/{path?} and /filer/display/{disk}/{path?} with no auth middleware. The user-controlled disk and path go straight to Storage::disk(), so anyone can read private uploads from the local disk (storage/app) or S3 disks. A public write-up gives a repro. No patched release is known; the maintainer issue #429 (March 2026) is still open.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"LavaLite CMS","fixed":[],"affected":"<= 10.1.2","ecosystem":"composer"}],"ecosystems":[],"tags":["filer","laravel","lavalite","package","php","s3","self-hosted"],"not_affected_if":["auth-required","no-filer-module","routes-blocked-at-proxy"],"how_to_check":"On a test copy, put a file in storage/app and request GET /filer/download/local/<file> without logging in. A 200 response with the file means you are exposed. Also check routes: php artisan route:list | grep filer, and composer show lavalite/framework (or cms version <= 10.1.2).","fix":"No fixed version published as of 2026-10-24 (unknown). Workaround: put the filer/download and filer/display routes behind auth middleware or block them at the web server/WAF, and restrict which disks FileController accepts. Move private files to a non-served disk and rotate any secrets stored in uploads. Watch LavaLite/cms releases after v10.1.2.","status":"open","published_at":"2026-10-20T11:17:20+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:37:21+00:00","updated_at":"2026-10-24T00:14:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:37:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LavaLite CMS: unauthenticated download of private uploaded files","impact":"medium","summary":"LavaLite CMS through 10.1.2 has a Filer module that lacks authentication on its download and display routes. An unauthenticated attacker can request arbitrary disk names and paths to read private uploads from local storage or remote S3 disks.","category":"package","who_cares":["lavalite","laravel","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Private uploaded files readable by anyone who can reach the site","analyst_note":"Confirm the patched version and whether the filer/download and filer/display routes are present by default; check the NVD entry for the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","no-filer-module"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000462,"input_tokens":2924,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched version and whether the filer/download and filer/display routes are present by default; check the NVD entry for the fixed release.","search":"'-113358':11A,14A '-2026':10A,13A '/filer/display':38B '/filer/download':34B '10.1.2':28B,96C '2026':89B '429':87B 'allow':107C 'anyon':58B 'arbitrari':123C 'attack':109C,120C 'auth':43B 'authent':100C 'cms':2A,16A,27B,94C 'configur':138C 'contain':97C 'control':48B 'cve':9A,12A 'disk':35B,39B,49B,56B,66B,70B,124C,141C 'download':4A,111C 'file':8A,113C 'filecontrol':129C 'filer':17B,30B,104C 'filer/display':118C 'filer/download':116C 'get':33B 'give':76B 'go':52B 'host':25B 'issu':86B 'known':83B 'laravel':18B 'lavalit':1A,19B,26B,93C 'lavalite':15A 'local':65B,135C 'maintain':85B 'march':88B 'middlewar':44B 'miss':99C 'modul':31B,105C 'name':125C 'open':92B 'packag':20B 'patch':80B 'path':36B,40B,51B,127C 'php':21B 'privat':6A,61B,132C 'public':72B 'read':60B 'regist':32B 'releas':81B 'remot':139C 'repro':78B 'retriev':131C 'rout':119C 's3':22B,69B,140C 'self':24B 'self-host':23B 'still':91B 'storag':55B,136C 'storage/app':67B 'store':112C 'straight':53B 'suppli':122C 'unauthent':3A,108C 'upload':7A,62B,133C 'user':47B 'user-control':46B 'vulner':101C 'write':74B 'write-up':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-113358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113358","severity":null,"published_at":"2026-10-20T11:17:20+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113358:618","url":null,"severity":null,"published_at":"2026-10-24T00:14:55+00:00","modified_at":"2026-10-24T00:14:55+00:00","first_seen_at":"2026-10-24T00:14:55+00:00","fetched_at":"2026-10-24T00:14:55+00:00","note":"Read VulnCheck advisory, public gist PoC (GET /filer/download/local/test.txt), GitHub issue #429 and Filer routes: routes are default in the Filer module, no auth. No fixed version published; v10.1.2 is the last release listed and is itself affected. No exploitation reports found; X not checked."}],"documents":[{"id":2496,"url":"https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-missing-authentication-via-filer-download-routes","title":"VulnCheck: LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2497,"url":"https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0","title":"kazisabu: Unauthenticated File Read in LavaLite Filer (repro GET /filer/download/local/test.txt)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2498,"url":"https://github.com/LavaLite/cms/issues/429","title":"LavaLite/cms #429: Unauthenticated file download/upload and guard confusion (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2499,"url":"https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/routes/web.php","title":"Filer routes/web.php: download/display routes with no auth","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}