CVE-2026-113358

LavaLite CMS versions through 10.1.2 are vulnerable to a missing authentication flaw in the Filer module . This vulnerability allows unauthenticated attackers to access the filer/download and filer/display routes. By providing arbitrary disk names and paths to the FileController , an attacker can...

CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...