CVE-2026-109168— lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
Quick assessment
Affected
dromara lamp-cloud
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
lamp-cloud 5.10.1 及更早版本存在一个不安全的直接对象引用漏洞。该漏洞允许经过身份验证的用户通过向 listFileByBizId 端点传入任意 bizId，列举其他业务对象的文件附件。攻击者可以获取文件名、存储路径、MD5 哈希值以及存储的 URL。在默认采用 LOCAL 存储模式下，这些文件无需登录即可通过 /anyTenant/file 路径直接访问。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dromara | lamp-cloud | ≤ 5.10.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109168
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
Source: CVE Program / CVE List V5
Vulnerability Description
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dromara | lamp-cloud | 0 ~ 5.10.1 | - |
|
II. Public POCs for CVE-2026-109168
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109168
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-109168 (1)
Proof of Concept for CVE-2026-109168 (1)
News Coverage for CVE-2026-109168 (1)
IV. Related Vulnerabilities
Same product: lamp-cloud
-
CVE-2026-109166
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById -
CVE-2026-94536
lamp-cloud through 5.10.0 Unauthorized Information Disclosur -
CVE-2026-94535
lamp-cloud through 5.10.0 Unauthorized Notification Deletion -
CVE-2026-94534
lamp-cloud through 5.10.0 Unauthorized Profile Modification -
CVE-2026-94533
lamp-cloud through 5.10.0 Unauthorized File Download via /an
Same vendor: dromara
-
CVE-2026-109166
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById -
CVE-2026-107781
Dromara Skyeye Unauthenticated SSRF and File Overwrite via e -
CVE-2026-107780
Dromara Skyeye Unauthenticated OS Command Injection via text -
CVE-2026-107779
Dromara Skyeye xxl-job-admin Missing Authentication on Job E -
CVE-2026-94536
lamp-cloud through 5.10.0 Unauthorized Information Disclosur
Same weakness: CWE-639
-
CVE-2026-109116
AdithyaYelloju Restaurant-Management-System Order Management -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109568
Shaark 1.2.13 through 1.2.44 Missing Authorization via API U -
CVE-2026-109427
Telegram-Stremio 5.1.0 Broken Object Authorization via Strea -
CVE-2026-108924
getkirby Kirby Dynamic Option Generation OptionsQuery.php re
V. Comments for CVE-2026-109168
No comments yet