CVE-2026-94533CWE-639

CVE-2026-94533

Medium · published September 22, 2026

CVSS v3.1

6.5

EPSS

Percentile

36.8

In the wild

Unconfirmed

What it is

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00436 · 36.8th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-09-22T02:17Z

References (4)

https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py · [email protected]https://github.com/dromara/lamp-cloud · [email protected]https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106 · [email protected]https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file · [email protected]

EPSS history

Timeline

23 SEP 03:49Z
EPSS moved — → 0%
epss
21 SEP 21:28Z
lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
cvelistv5