Threats affecting pkg:github/dromara/lamp-cloud

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-19757 is a path traversal vulnerability in Dromara lamp-cloud affecting versions up to and including 5.10.0. The flaw exists in the FileAnyoneController.java component, specifically in the File-Upload Controller, where manipulation of the bucket/bizType argument allows unauthorized path traversal. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix.

A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.