CVE-2026-9498
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 25, 2026
- Updated
- May 28, 2026
- Reserved
- May 25, 2026
Description
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
lamp-cloudDromara |
|
References
- VDB-365481 | Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template enginevdb-entrytechnical-description
- VDB-365481 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #814103 | dromara lamp-cloud releases Injectionthird-party-advisory
- https://github.com/Ku4D3/bug_story/blob/main/report_02.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.