CVE-2026-113358

LavaLite CMS versions through 10.1.2 are vulnerable to a missing authentication flaw in the Filer module . This vulnerability allows unauthenticated attackers to access the filer/download and filer/display routes. By providing arbitrary disk names and paths to the FileController , an attacker can...