CVE-2026-69100 LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
Attackers can execute arbitrary Groovy code and OS commands on the backend server by injecting scripts into database template fields via message template endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-69100?
CVE-2026-69100 is a high-severity code injection vulnerability in dromara lamp-cloud, published on 4 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.
Weakness: CWE-94
Which versions are affected by CVE-2026-69100?
How do I fix CVE-2026-69100?
No fix has been published for CVE-2026-69100 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-69100 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69100 exists.
Sources
Also known as GHSA-g2rg-5634-4c27.