---
id: CVE-2026-94533
title: >-
  lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in
  FileAnyoneController that allows authenticated users to download arbitrary
  attachments
summary: >-
  lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in
  FileAnyoneController that allows authenticated users to download arbitrary
  attachments. Attackers can retrieve other users' stored files by supplying
  valid attac…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: dromara
product: lamp-cloud
affected:
  - lamp-cloud <= 5.10.0
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94533'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-02-anyone-file-download-bola.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dromara/lamp-cloud'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-base/lamp-base-controller/src/main/java/top/tangyh/lamp/file/controller/FileAnyoneController.java#L88-L106
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-file-download-via-anyone-file
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0025
epssPercentile: 0.16721
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T13:02:18.118598Z'
ingestedAt: '2026-09-21T21:53:57.427Z'
---

## Overview

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.