CVE-2026-69100 PUBLISHED

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

Assigner: VulnCheck
Reserved: 03.08.2026 Published: 04.08.2026 Updated: 04.08.2026

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	dromara
Product	lamp-cloud
Versions	Default: affected affected from 0 to 5.6.2 (incl.) Version 84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3 is unaffected

CVE-2026-69100 PUBLISHED

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

Metrics

Product Status

Credits

References

Problem Types