CVE-2026-94533: lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-09-22
Weakness: CWE-639

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

Affected products

dromara lamp-cloud: through 5.10.0

References

https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py
https://github.com/dromara/lamp-cloud
https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106
https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file

Get alerted when CVE-2026-94533 or the next vulnerability affects your stack