LavaLite CMS 10.1.2 High-Severity CVE-2026-113358 Enables Unauthenticated Access to Private Files

Security teams must address a missing authentication flaw in LavaLite CMS that permits unauthorized file downloads. The vulnerability, identified as CVE-2026-113358, exists in versions of the content management system up to 10.1.2. According to the National Vulnerability Database, this issue resides in the Filer module. It allows unauthenticated attackers to retrieve stored files by exploiting specific application routes.

The risk

The flaw stems from a lack of authentication checks within the Filer module. Attackers can target the filer/download and filer/display routes to access data. By supplying arbitrary disk names and paths to the FileController, malicious actors can bypass security controls. This enables the retrieval of private uploads from local storage systems. The vulnerability also extends to configured remote S3 disks, broadening the potential scope of data exposure.

Who is exposed

Organizations running LavaLite CMS versions 10.1.2 or earlier are directly exposed to this threat. The NVD record confirms that the vulnerability affects all iterations of the software up to this specific version. Any instance where the Filer module is active and accessible to the internet presents a risk. Small-business owners relying on this CMS for customer data or internal documents face immediate exposure if their systems are not updated.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 8.7 to this vulnerability, classifying it as High severity. The weakness is categorized under CWE-306, which denotes missing authentication for critical functionality. No specific financial costs or regulatory penalties are detailed in the source material. However, the high severity rating indicates significant potential impact on confidentiality for affected systems.

What to watch

Managers should verify the current version of LavaLite CMS installed on their servers. If the version is 10.1.2 or lower, the system is vulnerable. Teams should monitor for any unauthorized access attempts to the Filer module routes. Checking for recent updates from the vendor is essential, as no patch has been confirmed in the available records.

Signals worth monitoring

Teams usually review web server access logs for requests to sensitive endpoints like download or display routes. Look for successful responses to these paths from unauthenticated IP addresses. Check whether any unusual file sizes are being transferred out of the server. Monitor for repeated attempts to access non-existent files, which may indicate path traversal testing. Containment moves typically involve restricting access to the Filer module at the firewall level while a fix is sought.

What to do and how to stay safe: LavaLite CMS

• Audit your server to confirm the installed version of LavaLite CMS and compare it against the vulnerable range.
• Restrict network access to the Filer module endpoints using firewall rules or web application firewalls.
• Monitor server logs for unauthorized requests to the filer/download and filer/display routes.
• Isolate affected systems from the internet if unauthorized data access is suspected until a vendor update is available.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of LavaLite CMS are affected by CVE-2026-113358?

All versions of LavaLite CMS up to and including 10.1.2 are affected by this vulnerability.

What is the severity of this vulnerability?

The National Vulnerability Database rates the vulnerability as High with a CVSS score of 8.7.

How do attackers exploit this flaw?

Attackers exploit the missing authentication in the Filer module to download files via specific routes.