CVE-2026-113358

{
  "etk_id": "ETK-2026-2158",
  "cve_id": "CVE-2026-113358",
  "display_id": "CVE-2026-113358",
  "ghsa_id": "GHSA-mr53-92q8-jc4r",
  "euvd_id": "EUVD-2026-104929",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in LavaLite CMS Filer downloads",
  "summary": "LavaLite CMS through 10.1.2 does not require authentication for affected Filer download and display functionality. An unauthenticated attacker who can reach those routes may retrieve private uploaded files from local storage or configured S3 disks.",
  "mitigation": "Restrict access to the affected Filer routes immediately, such as by requiring authentication at the application or reverse-proxy layer, and limit public reachability of the CMS. Apply a vendor update when a fixed release is published; no fixed version is recorded in the advisory.",
  "vendor": "lavalite",
  "product": "cms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 10.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "cms",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 54.553450983333335,
  "t0_at": "2026-10-20T10:41:42.303000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-20T10:41:42.303000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T10:41:42.303000+00:00",
      "url": "https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0"
    },
    "trigger_signal": {
      "at": "2026-10-20T10:41:42.303000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T10:41:42.303000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113358"
    }
  }
}