LavaLite CMS CVE-2026-113358

Exploitable against default deployments of LavaLite CMS (through 10.1.2) wherever the Filer module's filer/download and filer/display routes are reachable, which they are by default - no authentication, user interaction, or special privileges are required. The attacker must supply a disk name and file path to FileController; because arbitrary disk names and paths are accepted, both local storage uploads and any configured remote S3 disks are in scope. The practical limiting factor is that the attacker must know or enumerate valid file paths/disk names to retrieve specific private files; impact is confined to confidentiality (file disclosure) with no integrity or availability effect.

Multiple signals align to make this a credible priority rather than an inflated high-score issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the sole impact is high confidentiality (VC:H) with no integrity or availability effect - consistent with CWE-306 (Missing Authentication) and the description of arbitrary file disclosure. Publicly available exploit code exists (a gist referenced by the CVE and by VulnCheck's advisory), which raises practical risk beyond theory. However, this is NOT listed in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - the signal is 'exploitable and public' rather than 'being used in the wild.' The confidentiality-only impact also bounds the damage: an attacker reads private files but cannot directly modify data or disrupt service. Net: treat as a real, patch-soon issue for anyone running LavaLite CMS, tempered by the product's limited deployment footprint and the absence of KEV/EPSS corroboration for mass exploitation.

An unauthenticated attacker sends crafted HTTP requests to the exposed filer/download and filer/display routes, supplying arbitrary disk names and file paths to the FileController. Because authentication is missing, the application returns private uploads from local storage or configured remote S3 disks, exfiltrating sensitive documents. A public proof-of-concept exploit already exists, lowering the skill barrier to carry this out.