CVE-2026-19756 in lamp-cloud
Summary
by MITRE • 08/14/2026
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in Dromara lamp-cloud version 5.10.0 represents a critical path traversal flaw within the Code Generator component, specifically affecting the DefGenProjectController.java file. This security weakness stems from inadequate input validation and sanitization of user-supplied parameters, particularly the outputDir parent projectPrefix arguments that control directory paths during code generation processes. The vulnerability falls under CWE-23 Path Traversal and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables unauthorized directory access through manipulated input parameters.
The technical implementation of this flaw occurs when the application accepts user-provided directory paths without proper validation, allowing attackers to manipulate the outputDir parent projectPrefix arguments to traverse the file system hierarchy. This manipulation can potentially enable attackers to write generated code files to arbitrary locations on the server, bypassing intended security boundaries and access controls. The vulnerability's remote exploitability means that malicious actors can trigger this path traversal condition through network-based attacks without requiring physical access to the system.
The operational impact of this vulnerability extends beyond simple directory traversal, as it could potentially allow attackers to overwrite critical system files, inject malicious code into generated projects, or gain unauthorized access to sensitive information stored in adjacent directories. This represents a significant risk for organizations using lamp-cloud for automated code generation, as compromised systems could lead to complete application compromise and potential data breaches. The vulnerability's public disclosure status increases the likelihood of exploitation by threat actors who may leverage this weakness to establish persistent access within affected environments.
Security mitigations should focus on implementing strict input validation and sanitization measures that reject any path traversal attempts using techniques such as canonicalization checks, directory whitelisting, or absolute path normalization. Organizations should immediately implement proper parameter validation for all user-supplied inputs related to file system operations, ensuring that generated paths remain within designated safe directories. Additionally, privilege separation and least-privilege principles should be enforced during code generation processes to minimize potential damage from successful exploitation attempts. The vulnerability's delayed response from the project maintainers highlights the importance of proactive security monitoring and timely patch management practices.
The flaw demonstrates a classic security misconfiguration pattern where insufficient input validation allows attackers to manipulate system behavior through carefully crafted parameters. This vulnerability type is particularly dangerous in automated code generation systems where the application processes untrusted user inputs to create executable code, creating multiple potential attack vectors for malicious actors seeking to compromise development environments or production systems through path traversal attacks.