CVE-2026-9498
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Dromara lamp-cloud up to version 5.6.2 has a template injection vulnerability in the Message Template Handler component. The GroovyClassLoader.parseClass function does not neutralize special elements in the DefMsgTemplate.content argument, allowing remote code execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full system compromise.
Recommendation
Immediately update lamp-cloud to the latest version or apply a patch to prevent template injection.
Other vulnerabilities in lamp-cloud
See all- CVE-2026-19756Medium
A vulnerability in lamp-cloud up to version 5.10.0 affects an unknown part of DefGenProjectController.java in the Code Generator component. Manipulation of outputDir/parent/projectPrefix arguments leads to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-5529Medium
In Dromara lamp-cloud up to version 5.8.1, an improper authorization vulnerability exists in the pageUser function of /defUser/pageUser in the DefUserController component. Remote exploitation is possible and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.