High severity · published Aug 4, 2026
CVE-2026-69100
LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
8.8
CVSS
1%
EPSS
No
On KEV
Description
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
lamp-cloud · dromara
through 5.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69100
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69100
github.com
https://github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3
github.com
https://github.com/dromara/lamp-cloud/issues/408
www.vulncheck.com
https://www.vulncheck.com/advisories/lamp-gluefactory-unsandboxed-groovy-script-remote-code-execution
More from lamp-cloud
7.5
CVE-2026-91996
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
7.3
CVE-2026-19758
dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
7.3
CVE-2026-19757
Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
7.1
CVE-2026-94535
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
7.1
CVE-2026-94534
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints