CVE-2026-19757 in lamp-cloud
Summary
by MITRE • 08/14/2026
A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability in Dromara lamp-cloud version 5.10.0 represents a critical path traversal flaw within the File-Upload Controller component, specifically in the FileAnyoneController.java file. The vulnerability stems from insufficient input validation when processing the bucket/bizType parameters, allowing attackers to manipulate file paths and potentially access unauthorized directories on the server. The issue manifests as a path traversal attack where malicious actors can navigate beyond the intended directory boundaries through carefully crafted input parameters.
The technical implementation of this vulnerability aligns with CWE-22 Path Traversal attacks, which occur when applications fail to properly sanitize user-supplied input before using it in file system operations. In this case, the bucket/bizType arguments serve as the attack vector, where an attacker can inject directory traversal sequences such as "../" or similar patterns to move up directory levels and access files outside the intended upload location. The remote exploitability of this vulnerability means that attackers do not require physical access to the system, making it particularly dangerous for web applications exposed to untrusted users.
The operational impact of this vulnerability extends beyond simple unauthorized file access, as it could potentially lead to arbitrary code execution, data exfiltration, or complete system compromise depending on the server configuration and file permissions. Attackers could leverage this vulnerability to read sensitive configuration files, access database credentials, or even upload malicious payloads that could be executed by the web application. The fact that a public exploit exists significantly increases the risk profile of affected systems, as it removes the need for sophisticated attack development and allows any motivated threat actor to potentially compromise vulnerable installations.
Security practitioners should consider this vulnerability in the context of ATT&CK technique T1059 Command and Scripting Interpreter and T1566 Phishing with Malicious Attachments, as it could enable attackers to establish persistence or escalate privileges through file manipulation. The lack of response from the project maintainers despite early notification creates additional risk, as organizations using this software cannot rely on official patches or fixes in a timely manner. Organizations should implement immediate mitigations including input validation, directory restriction, and access control measures while monitoring for exploitation attempts.
The vulnerability demonstrates the critical importance of proper parameter validation and secure coding practices in web applications, particularly when handling user-supplied data for file operations. It underscores the need for regular security assessments and vulnerability management processes that can identify and remediate such issues before they can be exploited in the wild. Organizations should also consider implementing network-level protections such as web application firewalls and intrusion detection systems to help detect and block exploitation attempts targeting this specific vulnerability pattern.