CVE-2026-19757
Received Received - Intake

Path Traversal in Dromara Lamp-Cloud File-Upload Controller

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19757
EUVD
EUVD-2026-58551

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara lamp-cloud to 5.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the Dromara lamp-cloud project up to version 5.10.0. It affects the file upload functionality in the FileAnyoneController.java component. The vulnerability allows attackers to manipulate the bucket and bizType parameters to traverse outside the intended directory and write files to arbitrary locations on the host system. This occurs because the parameters are directly concatenated into the filesystem path without validation.

Detection Guidance

Check if the /anyone/file/upload endpoint is exposed without authentication by sending a request with path traversal payloads in bucket/bizType parameters. Example: curl -X POST http://target/lamp-cloud/anyone/file/upload -d 'bucket=../../../etc&bizType=test'

Monitor filesystem writes outside intended directories, especially in web roots or system paths. Look for unexpected UUID-named files in arbitrary locations.

Impact Analysis

This vulnerability could allow attackers to overwrite critical files such as configuration files or classpath resources. This may lead to remote code execution, unauthorized data access, or system compromise. The attack can be initiated remotely without authentication, making it particularly dangerous.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing or modifying sensitive data. For GDPR, this may result in violations of data integrity and confidentiality requirements. For HIPAA, it could compromise protected health information if medical data is involved. Both standards mandate strict access controls and data protection measures, which this flaw undermines.

Mitigation Strategies

Disable or restrict access to the /anyone/file/upload endpoint until patched. Implement strict validation for bucket and bizType parameters to prevent path traversal. Enforce authentication and role-based access controls on the endpoint.

Apply path canonicalization to ensure final filesystem paths stay within intended directories. Consider removing the endpoint if file uploads are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart