PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113358 lavalite CVE debrief

CVE-2026-113358 debrief: Unauthenticated file downloads are possible via the LavaLite CMS Filer module, allowing attackers to retrieve private uploads from local storage or configured remote S3 disks without proper authentication, impacting confidentiality and potentially leading to further exploitation. Defenders should verify exposure and apply patches or mitigations to prevent unauthorized access. This vulnerability is particularly concerning due to the ease of exploitation and potential for data breaches.

Vendor
lavalite
Product
cms
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders of LavaLite CMS deployments, including system administrators, security teams, and vulnerability management teams, should verify exposure and apply patches or mitigations to prevent unauthorized file downloads. This vulnerability is particularly concerning for organizations using LavaLite CMS for sensitive data storage or in high-risk environments.

Why it matters

Unauthenticated file downloads possible via LavaLite CMS Filer module, defenders should verify exposure and apply patches

  • Verify exposure of LavaLite CMS Filer module
  • Apply patches or mitigations to prevent unauthorized file downloads
  • Monitor for unauthorized file downloads

Technical summary

LavaLite CMS Filer module has a missing authentication vulnerability allowing unauthenticated file downloads through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks, impacting confidentiality and potentially leading to further exploitation if not properly mitigated. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent unauthorized access.

Defensive priority

Defenders should prioritize verifying exposure and applying patches

Recommended defensive actions

  • Verify exposure of LavaLite CMS Filer module in managed environments
  • Apply patches or mitigations through normal change control
  • Review compensating controls for exposed systems
  • Monitor for unauthorized file downloads
  • Track exceptions and retest remediated assets
  • Review relevant logs for exposed assets
  • Assign an owner for follow-up and documentation

Evidence notes

The CVE record and source item provide details on the missing authentication vulnerability in the LavaLite CMS Filer module. Evidence is based on the official CVE Program record and supplemental source references. The vulnerability allows unauthenticated file downloads through the filer/download and filer/display routes, with attackers able to supply arbitrary disk names and paths to retrieve private uploads.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113358 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113358

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113358 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113358

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113358.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0

    Supplemental source - exploit, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/routes/web.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/Http/Controllers/FileController.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/LavaLite/cms/releases/tag/v10.1.2

    Supplemental source - product, release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-missing-authentication-via-filer-download-routes

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.