CVE-2026-94533
6.5 MEDIUMpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI risk analysis
- Summary
- This vulnerability allows authenticated users to download any file stored by other users due to a lack of proper file ownership validation, enabling unauthorized access to sensitive information.
- Exploitability
- Exploitation requires authentication and knowledge of valid attachment identifiers; attackers can easily retrieve files from other user accounts.
- Blast radius
- The impact is significant as it could lead to data breaches and loss of confidentiality for stored files across the system.
- Prioritized remediation
- Update to the latest version of lamp-cloud (5.10.1 or later) which includes fixes for this vulnerability.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py
- https://github.com/dromara/lamp-cloud
- https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106
All references
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py
- https://github.com/dromara/lamp-cloud
- https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106
- https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-9273
- MEDIUMCVE-2026-93340PoC
- MEDIUMCVE-2025-71420PoC
- HIGHCVE-2026-48826PoC
- HIGHCVE-2026-48976PoC
- MEDIUMCVE-2026-52743PoC
- MEDIUMCVE-2026-55625PoC
- HIGHCVE-2026-55739PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.