What is CVE-2026-69100?

CVE-2026-69100 is a high-severity vulnerability in Dromara Lamp-Cloud, classified under Code Injection. CVSS score: 8.8/10. Published 2026-08-04.

How severe is CVE-2026-69100?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Dromara Lamp-Cloud

CVE-2026-69100

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Dromara Lamp-cloud — versions 0, 84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3

Weakness classification (CWE)

CWE-94 — Code Injection

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-69100?: CVE-2026-69100 is a high-severity vulnerability in Dromara Lamp-Cloud, classified under Code Injection. CVSS score: 8.8/10. Published 2026-08-04.
How severe is CVE-2026-69100?: High severity. CVSS v3 base score is 8.8 out of 10.