Description
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
Published: 2026-08-04
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unsandboxed Groovy script execution flaw in LAMP Rapid Development Platform version 5.6.2. Unsandboxed code that is read from database template fields passed to the GlueFactory is executed with no validation, compilation restrictions, or whitelisting. This allows an attacker to inject arbitrary Groovy code and trigger OS commands on the backend server, giving complete control over the affected system. The weakness is a classic code injection flaw (CWE‑94).

Affected Systems

The affected product is the open‑source LAMP Rapid Development Platform from dromara, specifically version 5.6.2. Users of earlier or patched releases are not affected; the fix is provided in commit 84b0c27c of the project repository.

Risk and Exploitability

The CVSS score of 8.7 places this issue in the High severity band. The EPSS score is not available, but the lack of a KEV listing does not reduce its risk; the flaw is exploitable over the network through the message template endpoints that allow an attacker to influence the script field. Once executed, the attacker can gain full system compromise on the backend server.

Generated by OpenCVE AI on August 4, 2026 at 19:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch referenced in commit 84b0c27 or upgrade to a newer LAMP release that contains the fix.
  • Restrict access to the message template endpoints or remove the ability for untrusted users to modify database template fields used by GlueFactory.
  • If a patch is not immediately available, disable GlueFactory or remove Groovy script support until a sandboxed implementation is deployed.

Generated by OpenCVE AI on August 4, 2026 at 19:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Dromara
Dromara lamp-cloud
Vendors & Products Dromara
Dromara lamp-cloud

Tue, 04 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
Title LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Dromara Lamp-cloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-04T15:47:30.481Z

Reserved: 2026-08-03T10:44:14.336Z

Link: CVE-2026-69100

cve-icon Vulnrichment

Updated: 2026-08-04T15:47:26.156Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T19:45:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')