# CVE-2026-69100: LAMP Rapid Development Platform remote code execution in GlueFactory

Source: https://junglewise.ai/threats/cve-2026-69100-lamp-rapid-development-platform-remote-code-execution-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69100 · Severity: high · CVSS 8.8 · Published 2026-08-04

LAMP is a rapid application development platform that processes message templates containing scripts. The platform executes Groovy scripts from database template fields without sandboxing or safety restrictions. An attacker who can modify template scripts through message template endpoints can execute arbitrary code and system commands on the backend server, potentially compromising the entire application infrastructure.

Vendors: [Dromara](https://junglewise.ai/threats/vendors/dromara).

## Quick answers

**Is CVE-2026-69100 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69100 being exploited in the wild.

**How severe is CVE-2026-69100?** High severity, with a CVSS score of 8.8, published 4 August 2026.

**Which products and versions are affected?** Dromara LAMP through 5.6.2.

**Is there a fix for CVE-2026-69100?** A patch was published on 2026-06-15: Fix applied in commit 84b0c27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69100 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69100?** Check whether you run Dromara LAMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated remote code execution (RCE) flaw in the GlueFactory component of LAMP Cloud. The vulnerable code path reads Groovy script content from the `script` field of message templates stored in the database and executes them using `GroovyClassLoader.parseClass()` followed by `InvokerHelper.createScript().run()`, with no sandboxing or whitelisting. An attacker can write or modify template scripts via the `/defMsgTemplate/save` endpoint (and potentially other message template endpoints) to inject arbitrary Groovy code, which is then executed with the privileges of the backend service when templates are sent via `/anyUser/extendMsg/sendByTemplate`. This allows command execution on the host system. The fix was applied in commit 84b0c27 on 2026-06-15. Versions through 5.6.2 are affected.

## Affected products

- dromara LAMP through 5.6.2

## Timeline

- 2026-06-07: disclosed: Issue #408 opened on GitHub
- 2026-06-15: patched: Fix applied in commit 84b0c27
- 2026-08-04: advisory: CVE-2026-69100 published

## References

- [https://github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3](https://github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3)
- [https://github.com/dromara/lamp-cloud/issues/408](https://github.com/dromara/lamp-cloud/issues/408)