lamp-cloud CVE-2026-9498

Exploitation requires an authenticated account with at least low-level privileges on the lamp-cloud instance sufficient to access the Message Template Handler and modify the DefMsgTemplate.content field - PR:L in the CVSS 4.0 vector confirms a low-privilege authenticated requirement. The vulnerability is not exploitable by unauthenticated users. The specific triggering condition is the application routing user-supplied template content through GroovyClassLoader.parseClass without sanitization; if message template functionality is disabled or access-restricted, exploitation is prevented. No additional platform-specific prerequisites are identified in the available data. Limiting factors include the requirement for a valid low-privilege account and access to the template editing workflow, which may be restricted in tightly administered deployments.

The NVD/VulDB-assigned CVSS 4.0 score of 2.1 (Low) warrants scrutiny: the vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L scores the Vulnerable Component impact as Low across all three pillars. This is atypical for SSTI via GroovyClassLoader, which in practice commonly enables full Remote Code Execution - a discrepancy analysts should verify against the actual POC behavior. The Low impact ratings may reflect scope-limited scoring assumptions or a sandboxed execution environment not evident from the description; this is INFERRED, not confirmed by vendor advisory. EPSS is 0.04% at the 12th percentile, suggesting minimal observed exploitation activity so far. The public POC on GitHub (https://github.com/Ku4D3/bug_story/blob/main/report_02.md) materially lowers the bar for exploitation. The absence of vendor engagement and any patch elevates residual risk for users on affected versions. No CISA KEV listing at time of analysis. Net assessment: the raw CVSS score likely understates real-world risk for environments where low-privileged template editing access is broadly granted; organizations using lamp-cloud 5.6.x should treat this as a higher priority than the score alone suggests.

An attacker with a low-privileged account on a lamp-cloud 5.6.x instance navigates to the Message Template management interface and creates or edits a template, injecting a crafted Groovy payload (e.g., a string invoking Runtime.exec()) into the DefMsgTemplate.content field. Upon saving or previewing, the application passes the content to GroovyClassLoader.parseClass, which compiles and executes the payload within the server's JVM process. A public proof-of-concept on GitHub demonstrates this technique and substantially lowers the skill bar for exploitation.