Description

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T23:17:14.617Z",
  "pubdate": "2026-08-13T23:17:14.617Z",
  "executiveSummary": "A path traversal vulnerability has been identified in Dromara lamp-cloud up to version 5.10.0, specifically within the Code Generator component. The flaw resides in the handling of input parameters within the DefGenProjectController.java file.\nThis security defect allows remote attackers to manipulate specific arguments including outputDir, parent, and projectPrefix, leading to unauthorized directory traversal and arbitrary file system access or manipulation on the underlying host.\nThe vulnerability poses a severe risk to system integrity and confidentiality, as successful exploitation enables remote code execution or unauthorized file overwriting depending on the application context and process permissions.\nThe attack can be executed remotely over the network without requiring prior authentication or privileged access, lowering the barrier to exploitation. Public disclosure of the exploit increases the likelihood of active targeting in the wild.\nAt the time of analysis, the vendor has not responded to early issue reports regarding the problem, and an official security patch or fixed version remains unavailable in the public domain.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw caused by insufficient input validation and sanitization of user-supplied parameters within the Code Generator component of Dromara lamp-cloud up to version 5.10.0.\nThe affected source code is located in the DefGenProjectController.java file, where parameters such as outputDir, parent, and projectPrefix are processed and utilized in file system operations without proper restriction to a designated secure base directory.\nAttackers can exploit this weakness by supplying specially crafted strings containing directory traversal sequences (such as dot-dot-slash or relative path specifiers) via the vulnerable arguments during project generation requests.\nThe attack flow proceeds as follows: First, the remote attacker crafts an HTTP request targeting the vulnerable endpoint managed by DefGenProjectController.java. Second, the payload containing malicious path traversal sequences is injected into the outputDir, parent, or projectPrefix parameters. Third, the application processes these parameters to construct file paths for writing generated code artifacts. Fourth, the lack of robust path normalization and validation causes the application to resolve the manipulated path outside the intended workspace directory. Finally, the server attempts to write files to the targeted external directory, resulting in arbitrary file creation, overwriting, or directory traversal exposure.\nNetwork exposure is high as the vulnerable functionality is accessible remotely over standard network protocols without requiring authentication or specific user privileges. The post-exploitation impact depends on the execution context of the application server, potentially allowing attackers to overwrite critical system binaries, configuration files, or deploy web shells leading to full system compromise."
}