EUVD-2026-31733
GHSA-69m2-cj73-p6pp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine - SSTI). The affected component, GroovyClassLoader.parseClass, is a Groovy runtime facility that compiles arbitrary Groovy source code into executable JVM classes at runtime. When the application passes unsanitized user-supplied content from the DefMsgTemplate.content argument directly to this function, an attacker can inject syntactically valid Groovy code that the JVM compiles and executes in the server's process context. Groovy's deep integration with the Java standard library means injected code can access java.lang.Runtime, file I/O, network sockets, and reflection APIs, making the actual capability ceiling potentially higher than the CVSS score implies. The affected product, cpe:2.3:a:dromara:lamp-cloud:*:*:*:*:*:*:*:*, is an open-source microservices rapid development platform.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. As a primary compensating control, restrict access to the Message Template Handler to the minimum set of privileged administrators who require it, reducing the pool of accounts that can supply content to DefMsgTemplate.content. As a secondary control, implement an application-layer allow-list or sanitization layer that strips or rejects Groovy expression syntax (e.g., patterns matching class., execute(, Runtime, ProcessBuilder) before content reaches GroovyClassLoader.parseClass - note this is a defense-in-depth measure and not a reliable substitute for patching due to Groovy's expressive syntax. If the Message Template Handler feature is not operationally required, disabling it at the routing or configuration level eliminates the attack surface entirely. Monitor https://vuldb.com/vuln/365481 and the upstream Dromara repository for a vendor fix; there is no confirmed patched version to upgrade to at this time.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today