Threat Intelligence Database

A path traversal vulnerability exists in dromara lamp-cloud up to version 5.10.0 in the FileChunkController.java component's chunk-check endpoint. This vulnerability allows remote attackers to manipulate the 'Name' argument to perform unauthorized file path traversal. The vulnerability has a CVSS score of 7.3 (medium severity) and has been publicly disclosed. The project has been informed but has not yet responded or issued a fix.

A path traversal vulnerability exists in Dromara lamp-cloud up to version 5.10.0 in the FileAnyoneController.java component. This flaw allows remote attackers to manipulate the bucket or bizType arguments to access unauthorized file paths. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. Exploit code has been publicly disclosed, but there are no known exploits in the wild. The project maintainers have been notified but have not yet responded or issued a fix.

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-19757 is a path traversal vulnerability in Dromara lamp-cloud affecting versions up to and including 5.10.0. The flaw exists in the FileAnyoneController.java component, specifically in the File-Upload Controller, where manipulation of the bucket/bizType argument allows unauthorized path traversal. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix.

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.