EUVD-2026-84207
GHSA-75cj-c67p-vvgx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, low-privilege authenticated IDOR reading arbitrary files (C:H); no integrity or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
9DescriptionCVE.org
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
Articles & Coverage 1
AnalysisAI
Authenticated users of Dromara lamp-cloud through 5.10.0 can download other users' stored attachments by supplying a valid attachment identifier to the /anyone/file/down or /anyone/file/download endpoints in FileAnyoneController, which never validate the file's created_by owner column against the requesting principal (CWE-639, IDOR/BOLA). The flaw is network-reachable and low-complexity, requires only a low-privilege authenticated account and no user interaction, and yields high confidentiality impact with no integrity or availability effect; it is rated 7.1 under CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated lamp-cloud account (any low-privilege user, per PR:L) and a valid attachment identifier for another user's file; the request targets the /anyone/file/down and /anyone/file/download endpoints of FileAnyoneController, which never validate the requested file's created_by owner column. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H, base 7.1) describes a network-reachable, low-complexity IDOR requiring only low-privilege authentication and no user interaction, with high confidentiality impact and no integrity/availability effect - a coherent profile for a broken-object-level-authorization file-download flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available intelligence at time of analysis - the only source reference points at the vulnerable code at commit bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6, with no fix commit or patched release version disclosed, so track https://github.com/dromara/lamp-cloud and the VulnCheck advisory (https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file) and upgrade as soon as a release above 5.10.0 addresses this. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of Dromara lamp-cloud version 5.10.0 and earlier, and restrict access to the /anyone/file/down and /anyone/file/download endpoints by blocking them at the network perimeter or requiring additional authorization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today