Executive brief
Dromara lamp-cloud is a microservices development platform that includes a code generation tool. An authenticated attacker can exploit a path traversal vulnerability in the code generator endpoint to write files to arbitrary locations on the server, potentially overwriting configuration files or application code and achieving remote code execution.
Technical details
The vulnerability is a CWE-22 path traversal in the DefGenProjectController.java code generation endpoint. The POST /defGenProject/generator endpoint accepts a ProjectGeneratorVO request body containing outputDir, projectPrefix, and parent fields that are concatenated directly into file paths without canonicalization or confinement to a base directory. An authenticated attacker can supply traversal sequences (../) or absolute paths in these fields to write generated template output to arbitrary filesystem locations. The attack requires a valid authentication token but no elevated privileges. Depending on deployment, writing to classpath or configuration directories could enable RCE.
Affected products
- Dromara lamp-cloud up to 5.10.0
Timeline
- 2026-06-25: disclosed: Issue #411 opened on GitHub
- 2026-08-13: advisory: CVE-2026-19756 published