CVE-2026-69100
High
Description
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
SeverityHigh
CVSS8.8
Exploit probability—
ProductDromara Lamp-cloud
PublishedAug 4, 2026
First seenAug 4, 2026
Weakness typeCWE-94Code injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dromara lamp-cloud | v ≤ 5.6.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.