CVE-2026-69100 affects dromara lamp-cloud versions up to and including 5.6.2. The GlueFactory component executes Groovy scripts stored in database template fields without sandboxing or whitelisting, allowing remote attackers to inject and execute arbitrary Groovy code and OS commands. The vulnerability is triggered by writing or influencing the script field through message template endpoints. The flaw enables remote code execution on the backend server. A fix was introduced in commit 84b0c27, but no official patch or advisory details are provided in this data.

Successful exploitation allows remote attackers to execute arbitrary code and OS commands on the backend server without user interaction or privileges beyond low-level access. This can lead to full system compromise, data theft, or service disruption. The CVSS 4.0 score is 8.7 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 84b0c27, so upgrading to a version including this commit or later is recommended once an official release or patch is available. Until then, restrict access to message template endpoints and avoid using untrusted input in Groovy scripts stored in the database.