---
id: CVE-2026-109166
title: >-
  lamp-cloud through 5.10.1 contains an insecure direct object reference
  vulnerability that allows authenticated users to obtain storage URLs for other
  users' files by supplying arbitrary file ids
summary: >-
  lamp-cloud through 5.10.1 contains an insecure direct object reference
  vulnerability that allows authenticated users to obtain storage URLs for other
  users' files by supplying arbitrary file ids. Attackers can send another
  user's file id…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T13:17:29.147'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109166'
references:
  - url: >-
      https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/lamp-cloud/poc_findUrlById_url.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dromara/lamp-cloud/blob/d61184d7d402023fc3ea63b6bdbd7a1bfdb8ce92/lamp-base/lamp-base-biz/src/main/java/top/tangyh/lamp/file/strategy/FileContext.java#L147-L170
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dromara/lamp-cloud/blob/d61184d7d402023fc3ea63b6bdbd7a1bfdb8ce92/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L75-L80
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.1-idor-via-anyone-file-findurlbyid
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.110Z'
---

## Overview

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.