EUVD-2026-31733
GHSA-69m2-cj73-p6pp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine - SSTI). The affected component, GroovyClassLoader.parseClass, is a Groovy runtime facility that compiles arbitrary Groovy source code into executable JVM classes at runtime. When the application passes unsanitized user-supplied content from the DefMsgTemplate.content argument directly to this function, an attacker can inject syntactically valid Groovy code that the JVM compiles and executes in the server's process context. Groovy's deep integration with the Java standard library means injected code can access java.lang.Runtime, file I/O, network sockets, and reflection APIs, making the actual capability ceiling potentially higher than the CVSS score implies. The affected product, cpe:2.3:a:dromara:lamp-cloud:*:*:*:*:*:*:*:*, is an open-source microservices rapid development platform.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. As a primary compensating control, restrict access to the Message Template Handler to the minimum set of privileged administrators who require it, reducing the pool of accounts that can supply content to DefMsgTemplate.content. As a secondary control, implement an application-layer allow-list or sanitization layer that strips or rejects Groovy expression syntax (e.g., patterns matching class., execute(, Runtime, ProcessBuilder) before content reaches GroovyClassLoader.parseClass - note this is a defense-in-depth measure and not a reliable substitute for patching due to Groovy's expressive syntax. If the Message Template Handler feature is not operationally required, disabling it at the routing or configuration level eliminates the attack surface entirely. Monitor https://vuldb.com/vuln/365481 and the upstream Dromara repository for a vendor fix; there is no confirmed patched version to upgrade to at this time.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. Rate
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today