CVE-2026-109166

lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById

HIGH 7.1EPSS 0.2%

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.

Affected: dromara · lamp-cloud
CVSS v4.0 VULNCHECK: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.24% chance of exploitation in the next 30 days, 14th percentile
Published: 2026-10-12
Updated: 2026-10-13

Proof-of-concept exploits (1)

AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/lamp-cloud/poc_f…0★ · 2026-10-10

CVE-2026-109166

Proof-of-concept exploits (1)

References