CVE-2026-9498: Dromara lamp-cloud RCE Vulnerability

CVE-2026-9498 Overview

CVE-2026-9498 is a template injection vulnerability in Dromara lamp-cloud through version 5.6.2. The flaw resides in the Message Template Handler, specifically the GroovyClassLoader.parseClass function. Attackers can manipulate the DefMsgTemplate.content argument to inject Groovy code that the application parses without proper neutralization of special template engine elements [CWE-791]. The issue is exploitable remotely by an authenticated low-privileged user. Public disclosure includes proof-of-concept material, and the vendor did not respond to early outreach about the vulnerability.

Critical Impact
Authenticated remote attackers can supply crafted Groovy template content to GroovyClassLoader.parseClass, leading to code execution within the lamp-cloud application context.

Affected Products

Dromara lamp-cloud versions up to and including 5.6.2
Message Template Handler component
Deployments exposing the DefMsgTemplate.content field to authenticated users

Discovery Timeline

2026-05-25 - CVE-2026-9498 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9498

Vulnerability Analysis

The vulnerability sits in the Message Template Handler of Dromara lamp-cloud, a Java-based microservice platform. The handler accepts user-supplied template content stored in the DefMsgTemplate.content field. When the application processes a template, it passes this content directly to GroovyClassLoader.parseClass. Groovy parses arbitrary Java/Groovy source code at runtime, which means any expressions embedded in the template body are compiled and executed.

The Common Weakness Enumeration classifies this as [CWE-791]: Incomplete Filtering of Special Elements. The handler does not sanitize Groovy meta-syntax or restrict the parser to a safe expression subset. An authenticated attacker with permission to create or edit message templates can embed Groovy code that the loader compiles on the server.

The EPSS probability is 0.041% (12.7 percentile), indicating low predicted exploitation activity at present. No vendor patch is documented in the available references.

Root Cause

The root cause is direct invocation of GroovyClassLoader.parseClass on attacker-controllable input. Groovy's class loader treats input as source code rather than data. Without a sandboxed SecureASTCustomizer or allowlist of permitted expressions, every template effectively becomes executable code under the JVM's privileges.

Attack Vector

The attack vector is network-based and requires low privileges and no user interaction. An attacker authenticates to lamp-cloud, navigates to the message template creation or update endpoint, and submits a DefMsgTemplate.content payload containing Groovy expressions. When the template is rendered or validated, GroovyClassLoader.parseClass compiles the supplied content. The compiled class executes inline, allowing the attacker to invoke arbitrary Java APIs available to the application process. Public proof-of-concept details are referenced in the GitHub Bug Report and VulDB Vulnerability #365481.

No verified exploit code is reproduced here. Refer to the linked advisory for the precise payload structure.

Detection Methods for CVE-2026-9498

Indicators of Compromise

Unexpected entries in the def_msg_template database table containing Groovy meta-characters such as ${, @groovy., or Runtime.getRuntime().
Child processes spawned by the lamp-cloud JVM that are inconsistent with normal messaging activity, for example sh, bash, cmd.exe, or curl.
Outbound network connections initiated by the lamp-cloud application to attacker-controlled hosts shortly after template create or update API calls.
Application logs showing repeated POST or PUT requests to message template endpoints from a single authenticated user.

Detection Strategies

Inspect template content fields server-side for Groovy constructs before parsing, and alert on matches.
Correlate authenticated API calls to template endpoints with subsequent process creation events on the host.
Hunt for GroovyClassLoader invocations in application logs and stack traces tied to user input.

Monitoring Recommendations

Enable verbose audit logging on message template create, update, and render operations.
Forward JVM process creation and outbound connection telemetry to a central analytics platform.
Baseline normal child-process behavior for the lamp-cloud service and alert on deviations.

How to Mitigate CVE-2026-9498

Immediate Actions Required

Restrict access to the message template management endpoints to trusted administrative accounts only.
Remove or revoke template edit permissions for low-privileged service users until a patch is available.
Review the def_msg_template table for unexpected Groovy syntax and remove suspicious entries.
Monitor the lamp-cloud JVM for anomalous child processes and outbound connections.

Patch Information

No vendor patch is referenced in the available data. The vendor did not respond to disclosure outreach. Track the VulDB Vulnerability #365481 entry and the Dromara lamp-cloud project for future releases that address GroovyClassLoader.parseClass usage.

Workarounds

Replace direct GroovyClassLoader.parseClass calls with a sandboxed configuration using SecureASTCustomizer and an expression allowlist.
Apply server-side input validation that rejects template content containing Groovy keywords, imports, or method invocations.
Place the lamp-cloud service behind a web application firewall rule that blocks template payloads containing executable Groovy constructs.
Run the lamp-cloud JVM under a least-privilege OS account with restricted filesystem and network egress.

bash

# Example egress restriction for the lamp-cloud service account on Linux
# Block outbound traffic from the JVM user except to required dependencies
sudo iptables -A OUTPUT -m owner --uid-owner lampcloud -d 10.0.0.0/8 -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner lampcloud -j REJECT