RCE in Dromara Lamp-Cloud
CVE-2026-69100
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (63.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Dromara Lamp-Cloud — versions 0, 84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3
Weakness classification (CWE)
References
- github.com/dromara/lamp-cloud/issues/408 (technical-description, exploit)
- github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3 (patch)
- www.vulncheck.com/advisories/lamp-gluefactory-unsandboxed-groovy-script-remote-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-69100?
- CVE-2026-69100 is a high-severity vulnerability in Dromara Lamp-Cloud, classified under Code Injection. CVSS score: 8.8/10. Published 2026-08-04.
- How severe is CVE-2026-69100?
- High severity. CVSS v3 base score is 8.8 out of 10.