CVE-2026-19758
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability was determined in dromara lamp-cloud up to version 5.10.0 in the file FileChunkController.java of the chunk-check endpoint component. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can access files outside the intended directory, potentially leading to disclosure of sensitive data, file modification, or privilege escalation.
Recommendation
Update lamp-cloud to a patched version. If not possible, restrict access to the chunk-check endpoint and apply input validation for the Name argument.
Original NVD description (English source)
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.