---
id: "CVE-2026-113358"
kind: "vulnerability"
aliases: ["CVE-2026-113358"]
title: "LavaLite CMS: unauthenticated download of private uploaded files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "LavaLite CMS", "fixed": [], "affected": "<= 10.1.2", "ecosystem": "composer"}]
ecosystems: []
tags: ["filer", "laravel", "lavalite", "package", "php", "s3", "self-hosted"]
not_affected_if: ["auth-required", "no-filer-module", "routes-blocked-at-proxy"]
published_at: "2026-10-20T11:17:20+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:14:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113358", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:14:55+00:00"}]
---

# LavaLite CMS: unauthenticated download of private uploaded files

LavaLite CMS <= 10.1.2: the Filer module registers GET /filer/download/{disk}/{path?} and /filer/display/{disk}/{path?} with no auth middleware. The user-controlled disk and path go straight to Storage::disk(), so anyone can read private uploads from the local disk (storage/app) or S3 disks. A public write-up gives a repro. No patched release is known; the maintainer issue #429 (March 2026) is still open.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:LavaLite CMS affected <= 10.1.2 fixed ?

## How to check

On a test copy, put a file in storage/app and request GET /filer/download/local/<file> without logging in. A 200 response with the file means you are exposed. Also check routes: php artisan route:list | grep filer, and composer show lavalite/framework (or cms version <= 10.1.2).

## Fix

No fixed version published as of 2026-10-24 (unknown). Workaround: put the filer/download and filer/display routes behind auth middleware or block them at the web server/WAF, and restrict which disks FileController accepts. Move private files to a non-served disk and rotate any secrets stored in uploads. Watch LavaLite/cms releases after v10.1.2.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113358
- 2026-10-24T00:14:55+00:00 analyst — Read VulnCheck advisory, public gist PoC (GET /filer/download/local/test.txt), GitHub issue #429 and Filer routes: routes are default in the Filer module, no auth. No fixed version published; v10.1.2 is the last release listed and is itself affected. No exploitation reports found; X not checked.

## Documents

- [advisory] VulnCheck: LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-missing-authentication-via-filer-download-routes
- [describes] LavaLite/cms #429: Unauthenticated file download/upload and guard confusion (open) https://github.com/LavaLite/cms/issues/429
- [describes] Filer routes/web.php: download/display routes with no auth https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/routes/web.php
- [poc] kazisabu: Unauthenticated File Read in LavaLite Filer (repro GET /filer/download/local/test.txt) https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0

## From the sources

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_