CVE-2026-19756

Deferred Deferred - Pending Action

Path Traversal in Dromara lamp-cloud Code Generator

Publication date: 2026-08-13

Last updated on: 2026-08-18

Assigner: VulDB

Description

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-18

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-19756

EUVD

EUVD-2026-58550

Affected Vendors & Products

Vendor	Product	Version / Range
dromara	lamp-cloud	to 5.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Dromara lamp-cloud up to version 5.10.0. It exists in the DefGenProjectController.java file within the Code Generator component. The flaw allows manipulation of arguments like outputDir, parent, and projectPrefix to traverse directories outside intended paths. The attack can be executed remotely and has been publicly disclosed.

Detection Guidance

To detect this vulnerability, inspect the DefGenProjectController.java file in Dromara lamp-cloud versions up to 5.10.0 for improper handling of the outputDir, parent, or projectPrefix parameters. Check for path traversal patterns in logs or requests involving these parameters.

Impact Analysis

An attacker could access or modify files outside the intended directory, potentially leading to unauthorized data access, file corruption, or system compromise. Since the exploit is public, the risk of attack is higher. The impact depends on the application's permissions and data sensitivity.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance breaches if sensitive data is accessed or leaked due to the flaw.

Mitigation Strategies

Update Dromara lamp-cloud to a version beyond 5.10.0 if available. If not, restrict network access to the Code Generator component and monitor file system operations involving outputDir/parent/projectPrefix parameters.

Hi! I’m here to help you understand CVE-2026-19756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70