{"id":"CVE-2026-69100","published":"2026-08-04T16:16:28.340","lastModified":"2026-08-04T17:16:59.320","description":"LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/issues/408","tags":[]},{"url":"https://www.vulncheck.com/advisories/lamp-gluefactory-unsandboxed-groovy-script-remote-code-execution","tags":[]}],"exploitRefs":[{"url":"https://github.com/dromara/lamp-cloud/commit/84b0c27d3693e468c2c690d9fbc8ea9c22cd34e3","tags":[]},{"url":"https://github.com/dromara/lamp-cloud/issues/408","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows remote code execution by executing unsandboxed Groovy scripts from database template fields, leading to arbitrary code execution and potential server compromise.","exploitability":"Exploitation is relatively straightforward as attackers can write or influence script fields via message template endpoints, requiring only access to these endpoints.","blast_radius":"If exploited, the vulnerability could lead to full server compromise, allowing attackers to execute arbitrary commands and gain control over the backend server.","remediation":"Upgrade to the fixed version 5.6.2 or later, as specified in commit 84b0c27.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","groovy","database","remote"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:22:37.473Z"}}