CVE-2026-9498: medium-severity vulnerability in Dromara lamp-cloud
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Dromara · lamp-cloudpublic PoCs found — 1
cve_referencegithub.com/Ku4D3/bug_story/blob/main/report_02.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dromara lamp-cloud
In the same product, most dangerous first.
CVE-2026-19757MEDIUMDromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversalEPSS 0.6%CVE-2026-19756MEDIUMDromara lamp-cloud Code Generator DefGenProjectController.java path traversalEPSS 0.4%CVE-2026-5529MEDIUMDromara lamp-cloud DefUserController pageUser improper authorizationEPSS 0.3%