{"id":"CVE-2026-94533","published":"2026-09-21T22:17:00.173","lastModified":"2026-09-21T22:17:00.173","description":"lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py","tags":[]},{"url":"https://github.com/dromara/lamp-cloud","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106","tags":[]},{"url":"https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file","tags":[]}],"exploitRefs":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py","tags":[]},{"url":"https://github.com/dromara/lamp-cloud","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows authenticated users to download any file stored by other users due to a lack of proper file ownership validation, enabling unauthorized access to sensitive information.","exploitability":"Exploitation requires authentication and knowledge of valid attachment identifiers; attackers can easily retrieve files from other user accounts.","blast_radius":"The impact is significant as it could lead to data breaches and loss of confidentiality for stored files across the system.","remediation":"Update to the latest version of lamp-cloud (5.10.1 or later) which includes fixes for this vulnerability.","tags":["auth-bypass","web","download","vulnerability"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:21:12.424Z"}}