CVE-2026-19756
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in lamp-cloud up to version 5.10.0 affects an unknown part of DefGenProjectController.java in the Code Generator component. Manipulation of outputDir/parent/projectPrefix arguments leads to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker may gain access to files outside the allowed directory, potentially leading to disclosure of sensitive data or modification of system files.
Recommendation
Update lamp-cloud to the latest version if available, or apply security patches. Restrict access to the Code Generator component and monitor logs for suspicious requests.
Original NVD description (English source)
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.