Is CVE-2026-113358 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113358?

CVE-2026-113358 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-113358

Description

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.