CVE-2026-19758
Received Received - Intake

Path Traversal in Dromara Lamp-Cloud

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19758
EUVD
EUVD-2026-58552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara lamp-cloud to 5.10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the dromara lamp-cloud project up to version 5.10.0. It affects the chunk-check endpoint where the Name argument is used to construct a file path without proper validation. Attackers can manipulate this to access arbitrary files on the system using path traversal sequences like ../.

Detection Guidance

To detect this vulnerability, check if the /chunk/check endpoint is accessible on your lamp-cloud instance. Send a POST request with a crafted 'name' parameter containing path traversal sequences like '../' to probe for arbitrary files. Example using curl: curl -X POST http://<target>/chunk/check -H 'Content-Type: application/json' -d '{"name":"../../../../../etc/passwd","size":1234}'

If the endpoint responds with a boolean indicating file existence or size, the vulnerability likely exists. Review server logs for requests to /chunk/check with suspicious 'name' parameters.

Impact Analysis

An attacker could exploit this to probe for and determine the existence and exact size of arbitrary files on the server. This could lead to sensitive information disclosure, such as configuration files, user data, or system files. The vulnerability is remotely exploitable without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately disable or remove the /chunk/check endpoint if it is not required. If removal is not possible, implement strict input validation to reject paths containing '..', absolute paths, or path separators in the 'name' parameter.

Canonicalize file paths using Path.normalize() or getCanonicalFile() and ensure the constructed path remains within the intended uploadFolder. Enforce authentication and authorization checks on the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart