Medium severity · published May 25, 2026
CVE-2026-9498
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
lamp-cloud · Dromara
5.6.0; 5.6.1; 5.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9498
github.com
https://github.com/Ku4D3/bug_story/blob/main/report_02.md
vuldb.com
https://vuldb.com/submit/814103
vuldb.com
https://vuldb.com/vuln/365481
vuldb.com
https://vuldb.com/vuln/365481/cti
More from lamp-cloud
8.8
CVE-2026-69100
LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
7.5
CVE-2026-91996
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
7.3
CVE-2026-19758
dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
7.3
CVE-2026-19757
Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
7.1
CVE-2026-94535
lamp-cloud through 5.10.0 Unauthorized Notification Deletion