Executive brief
LAMP is a rapid application development platform that processes message templates containing scripts. The platform executes Groovy scripts from database template fields without sandboxing or safety restrictions. An attacker who can modify template scripts through message template endpoints can execute arbitrary code and system commands on the backend server, potentially compromising the entire application infrastructure.
Technical details
The vulnerability is an unauthenticated remote code execution (RCE) flaw in the GlueFactory component of LAMP Cloud. The vulnerable code path reads Groovy script content from the `script` field of message templates stored in the database and executes them using `GroovyClassLoader.parseClass()` followed by `InvokerHelper.createScript().run()`, with no sandboxing or whitelisting. An attacker can write or modify template scripts via the `/defMsgTemplate/save` endpoint (and potentially other message template endpoints) to inject arbitrary Groovy code, which is then executed with the privileges of the backend service when templates are sent via `/anyUser/extendMsg/sendByTemplate`. This allows command execution on the host system. The fix was applied in commit 84b0c27 on 2026-06-15. Versions through 5.6.2 are affected.
Affected products
- dromara LAMP through 5.6.2
Timeline
- 2026-06-07: disclosed: Issue #408 opened on GitHub
- 2026-06-15: patched: Fix applied in commit 84b0c27
- 2026-08-04: advisory: CVE-2026-69100 published