Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| dromara | lamp-cloud | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 21 Sep 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column. | |
| Title | lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file | |
| First Time appeared |
Tangyh
Tangyh lamp-cloud |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:tangyh:lamp-cloud:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Tangyh
Tangyh lamp-cloud |
|
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-09-21T21:28:12.305Z
Reserved: 2026-09-21T18:25:17.934Z
Link: CVE-2026-94533
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-639
Authorization Bypass Through User-Controlled Key