Lamp-Cloud - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/lamp-cloud/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 14 Aug 2026 02:05:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPath Traversal in Dromara lamp-cloudhttps://feed.craftedsignal.io/briefs/2026-08-lamp-cloud-path-traversal/Fri, 14 Aug 2026 02:05:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-lamp-cloud-path-traversal/An unauthenticated remote path traversal vulnerability in Dromara lamp-cloud allows attackers to access unauthorized files via the FileAnyoneController component.Dromara lamp-cloud, a cloud-based development platform, contains a critical path traversal vulnerability (CVE-2026-19757) affecting all versions up to 5.10.0. The vulnerability is located within the File-Upload Controller component, specifically in FileAnyoneController.java. An unauthenticated remote attacker can exploit this flaw by manipulating the 'bucket' or 'bizType' parameters, which are improperly sanitized before being used in file system operations. This allows the attacker to traverse directories and access files outside the intended scope on the server hosting the application. Public proof-of-concept exploits exist, and the maintainers have not yet provided a resolution. Given the remote, unauthenticated nature of this vulnerability, it poses a significant risk to the confidentiality and integrity of affected deployments.

Attack Chain

  1. Attacker performs reconnaissance to identify endpoints running Dromara lamp-cloud.
  2. Attacker probes the file upload functionality hosted by FileAnyoneController.java.
  3. Attacker constructs an HTTP request targeting the affected controller endpoint.
  4. Attacker injects path traversal sequences (e.g., ../../) into the 'bucket' or 'bizType' query parameters.
  5. The application fails to validate or sanitize the path input provided in the parameters.
  6. The server-side code resolves the path relative to the application's root directory, escaping the target storage folder.
  7. The server returns the contents of sensitive files or enables unauthorized write operations to the file system.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files from the server's file system. Depending on the server's configuration and the privileges of the service account running the lamp-cloud application, this may lead to the exfiltration of configuration files, credentials, or sensitive application data. The scope of impact is potentially high for any organization hosting this software in an internet-facing configuration.

Recommendation

Prioritize the identification and patching of Dromara lamp-cloud instances in your environment. Until a vendor patch is available, implement the following:

  • Monitor web server logs for requests containing path traversal sequences (e.g., "../") targeting the FileAnyoneController.java path.
  • Restrict access to the File-Upload Controller endpoints via WAF rules or reverse proxy configurations.
  • Audit application service account permissions to ensure the principle of least privilege, minimizing the damage of potential file read attempts.
  • Monitor for CVE-2026-19757 exploitation attempts by matching web logs against suspicious character patterns in URI parameters.
]]>highadvisory