LavaLite CMS up to version 10.1.2 has a missing authentication flaw in its Filer module that lets attackers download any stored file via the filer/download and filer/display routes. An unauthenticated user can supply arbitrary file names and paths, causing the FileController to return private uploads from local storage or remote S3 disks. This flaw enables disclosure of confidential data that should only be accessible to authorized users.

The vulnerability affects the LavaLite CMS product. All installations running version 10.1.2 or earlier are susceptible; no other affected versions are listed in the CNA data.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a web request to the vulnerable routes, no authentication or privileged environment is needed. The attacker can choose arbitrary disk names and paths, so the risk is significant for systems that store sensitive files on the server or linked S3 buckets.