LavaLite CMS: Missing authentication in Filer module allows file download

Summary

LavaLite CMS up to and including 10.1.2 does not check authentication for file download and display in the Filer module. An unauthenticated attacker can use the routes filer/download and filer/display with arbitrary disk names and paths to retrieve private uploads from local storage or configured S3 disks. The issue is exploitable over the network without an account or user interaction, and the impact is limited to confidentiality.

Affected

• LavaLite CMS up to and including 10.1.2
• Component: Filer module (Litepie/Filer)

Fixed in

Unknown.

• No fixed version was found in the sources reviewed. Version 10.1.2 is listed as affected.

Workaround

• Restrict access to the Filer routes (filer/download and filer/display) at the reverse proxy or WAF.
• Disable the Filer module if the site does not need it.
• Review access rights on local storage directories and on the S3 buckets or IAM policies behind the Filer disks.

Exploitation

• CISA SSVC: proof of concept available, automatable: yes, technical impact: partial.
• A GitHub gist with a description of the issue exists. Whether it is a working exploit is unverified.
• Not listed in CISA KEV. EPSS is low (0.00441).

Our recommendation

• Check whether LavaLite CMS is installed and whether the Filer module is enabled, including in lockfiles and deployed manifests.
• Block or restrict public access to the Filer routes until a fixed version is available.
• Check web server logs for requests to filer/download and filer/display from unexpected sources.
• If exposure is confirmed, treat affected files as compromised and assess whether personal data is involved.
• Monitor the vendor for a fixed release and apply it as soon as it is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• LavaLite CMS release v10.1.2 github.com
• LavaLite framework: FileController.php github.com
• LavaLite framework: Filer routes web.php github.com
• Gist: LavaLite CMS Filer unauthenticated file read gist.github.com
• OpenCVE CVE-2026-113358 app.opencve.io
• NVD record via Vulners vulners.com
• OSV record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:31.