CVE-2026-19756

Executive Summary

CVE-2026-19756 is a path traversal vulnerability (CWE-22) in the Dromara lamp-cloud microservices development platform, affecting versions up to and including 5.10.0. The flaw resides in the Code Generator component, specifically in the controller file DefGenProjectController.java, where the user-supplied arguments outputDir, parent, and projectPrefix are not adequately validated before being used in filesystem operations. An authenticated attacker with low privileges can exploit this remotely to read or write files outside the intended code-generation output directory, impacting the confidentiality, integrity, and availability of the target host. The vulnerability is publicly disclosed, but no upstream patch exists; the project maintainers were notified through an issue report and have not responded.

Technical Analysis

The vulnerable component is the Code Generator bundled with Dromara lamp-cloud, a Java/Spring-based microservice rapid-development platform. The affected class, DefGenProjectController.java, exposes a controller that orchestrates the generation of project scaffolding. The controller accepts at least three parameters that govern where and how generated source files are written to the server filesystem: outputDir (destination directory), parent (parent package/namespace), and projectPrefix (name prefix for the generated project).

The vulnerability class is path traversal (CWE-22). The application constructs filesystem paths by concatenating these parameter values with fixed base paths. Because the code either fails to sanitize the parameters or fails to perform canonicalization checks after processing, an attacker can inject traversal sequences (e.g., ../, ..%2f, ..%5c) into these parameters. When the server resolves the final path, the resulting location can escape the intended generation root directory.

Several factors amplify the severity despite the medium CVSS base score of 6.3:

• Remote exploitability (AV:N): The attack is launched over the network; no physical or local access is required.
• Low attack complexity (AC:L): No race conditions, special timing, or exotic conditions are required; a standard HTTP request with a malformed parameter is sufficient.
• Low privilege requirement (PR:L): An attacker only needs a low-privileged account on the platform, not administrative access. In typical deployments, developer or operator accounts with access to the generation console satisfy this condition.
• No user interaction (UI:N): The attack completes without tricking another user into performing an action.
• Unchanged scope (S:U): The compromise is confined to the security authority of the vulnerable component; it does not cross trust boundaries into other security domains.
• Partial impacts (C:L/I:L/A:L): The CVSS subscores indicate limited but real impact on confidentiality (reading files outside the intended directory), integrity (writing generated files to arbitrary paths), and availability (potentially disrupting services through overwritten files or exhausted disk space).

The issue was reported to the project through an issue tracker early in the disclosure process, but the maintainers have not responded. Consequently, there is no fixed version and no vendor-supplied workaround. The OSV database entry tracks the affected state as unfixed from commit 1d0243a578e4db59d84d29aaf129d5ff4999ba6d.

From the NVD description, no additional technical details are available about the exact HTTP endpoint mapping, request method, or parameter serialization format. The attack mechanics described below are therefore generalized to the path traversal vulnerability class, which is consistent with the disclosed information.

Exploitation Scenarios

No verified public exploit code repository is available at the time of writing, although the NVD description states that the exploit has been disclosed to the public. The following attack chain is inferred from the vulnerability class and the limited details in the advisory.

Step 1 — Reconnaissance and target identification.
An attacker identifies a lamp-cloud instance via service banners, login portals, or default application branding containing "lamp-cloud". Shodan/Censys searches using titles or body text such as "lamp-cloud" can locate exposed management consoles. The attacker then obtains low-privileged credentials — either through legitimate developer accounts, credential stuffing against weak passwords, or harvesting from prior breaches. Because the CVSS vector requires PR:L, a standard user account is sufficient; administrative access is not required.

Step 2 — Triggering the vulnerable code path.
The attacker authenticates to the platform and navigates to the Code Generator functionality that maps to DefGenProjectController.java. The generation request includes the parameters outputDir, parent, and projectPrefix. Instead of supplying benign values, the attacker crafts values containing traversal payloads, for example setting outputDir to a value such as ../../../../etc/ or ..%2f..%2f..%2f in an attempt to escape the base generation directory.

Step 3 — Payload delivery and exploitation.
Since the vulnerable code does not normalize or validate the paths, the server resolves the manipulated path and performs filesystem operations relative to it. Depending on the actual implementation, this can result in:

• writing generated Java, JSP, HTML, or configuration files to arbitrary directories writable by the lamp-cloud service account;
• reading source files, configuration files, or other sensitive content if the generation code reflects file content;
• overwriting existing files (e.g., application configuration or web resources) with attacker-influenced content.

Step 4 — Post-exploitation impact.
The immediate consequence is unauthorized file read/write outside the intended directory. If the attacker writes a JSP or other dynamically executed file into a web-accessible directory, this may escalate to remote code execution, depending on the servlet container configuration and the privileges of the running process. Even without RCE, an attacker can corrupt configuration files, causing denial of service, or exfiltrate sensitive filesystem data. The low availability impact in CVSS suggests the authors assessed the most likely outcome as partial data corruption or resource disruption rather than full host compromise; however, the severity can increase in environments where the service account runs with elevated filesystem privileges.

Impact Assessment

CVE-2026-19756 affects all Dromara lamp-cloud deployments running version 5.10.0 or earlier that expose the Code Generator feature to authenticated users. The platform is commonly used internally by development teams, so the most realistic attack vector is a malicious or compromised user with a low-privileged account (e.g., a developer onboarding into the platform) rather than an unauthenticated external attacker.

Business impact includes:

• Confidentiality (C:L): Exposure of files readable by the lamp-cloud process user, potentially including application source code, database connection strings, and secrets from adjacent directories.
• Integrity (I:L): Unauthorized file writes can deface web content, plant backdoors, or corrupt configuration and source files, undermining the integrity of the application and its generated artifacts.
• Availability (A:L): Overwriting critical configuration files or exhausting disk space with repeated generation requests may cause partial service disruption.

The EPSS score of 0.00288 places this vulnerability in the 21.4th percentile of exploited CVEs, indicating a low current probability of exploitation in the wild. CISA has not added CVE-2026-19756 to the Known Exploited Vulnerabilities catalog, and no evidence exists in the provided data linking this CVE to ransomware, APT campaigns, or other known threat actor activity. Nonetheless, the public disclosure of the exploit combined with zero patch availability increases the risk over time, particularly in internet-exposed management consoles where low-privileged credentials can be obtained.

Detection Guidance

The following detection content targets both network-level exploitation attempts and host-level artifacts of path traversal against the lamp-cloud Code Generator. Tune thresholds to your environment's baseline.

Sigma Rule

title: CVE-2026-19756 Dromara lamp-cloud Code Generator Path Traversal Attempt
id: 4f2c8b5e-9c31-4a7a-8f7a-1d9c2b6e4a10
status: experimental
description: Detects HTTP requests containing path traversal payloads in lamp-cloud code generator parameters outputDir, parent, or projectPrefix.
author: Valtersit Threat Intelligence
date: 2026/06/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19756
    - https://cwe.mitre.org/data/definitions/22.html
logsource:
    category: webserver
    product: generic
detection:
    selection_generator:
        cs-uri-query|contains:
            - "outputDir="
            - "parent="
            - "projectPrefix="
    selection_traversal:
        cs-uri-query|contains|windash:
            - "../"
            - "..%2f"
            - "..%252f"
            - "..%5c"
            - "..%c0%af"
    condition: selection_generator and selection_traversal
    level: high
falsepositives:
    - Internal development tools generating paths with legitimate relative traversal (review against baseline)

YARA Rule

rule CVE_2026_19756_lamp_cloud_path_traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads targeting Dromara lamp-cloud DefGenProjectController path traversal (CVE-2026-19756)"
        cve = "CVE-2026-19756"
        date = "2026-06-01"
    strings:
        $class = "DefGenProjectController"
        $a1 = "outputDir"
        $a2 = "parent="
        $a3 = "projectPrefix"
        $t1 = "../"
        $t2 = "..%2f"
        $t3 = "..%252f"
        $t4 = "..\\"
        $t5 = "..%5c"
    condition:
        (any of ($a*) and any of ($t*)) or
        ($class and any of ($t*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-19756 Dromara lamp-cloud Code Generator Path Traversal Attempt"; flow:established,to_server; http.uri; content:"outputDir"; nocase; http.uri; content:"projectPrefix"; nocase; pcre:"/(?:\.\.|%2e%2e|%252e)[\/\\%]/i"; classtype:attempted-admin; reference:cve,2026-19756; sid:202619756; rev:1; metadata:created_at 2026-06-01;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where event.category == "network" and network.protocol == "http"
      and url.query : "*outputDir*" and url.query : "*../*"]
  [ file where event.category == "file"
      and (file.path : "*\\..\\*" or file.path : "*/../*")
      and event.action in ("creation", "rename", "write", "change")]

This EQL query correlates an inbound HTTP request carrying the outputDir parameter alongside traversal characters with a subsequent file event whose path contains a traversal sequence. The correlation window limits false positives from background file activity.

Splunk SPL Query

index=web sourcetype=access_combined earliest=-15m
  (uri_query=*outputDir* OR form_data=*outputDir* OR uri_query=*projectPrefix* OR form_data=*projectPrefix*)
  AND (uri_query=*../* OR form_data=*../* OR uri_query=*..%2f* OR form_data=*..%2f* OR uri_query=*..%5c* OR form_data=*..%5c*)
| stats count by src_ip, uri_path, uri_query, user
| where count > 3
| rename src_ip as "Source IP", uri_path as "Requested Path", uri_query as "Query", user as "Authenticated User"
| sort - count

Supplement with host-level file monitoring:

index=host_monitor sourcetype=syslog
  (file_path=*../* OR file_path=*..\\*)
  AND (file_name=*.java OR file_name=*.jsp OR file_name=*.xml OR file_name=*.properties)
  AND NOT file_path=*\/lamp-cloud\/*
| table _time, host, user, file_path, file_name

Wazuh OSSEC Rule

<group name="web, cve_2026_19756,">
    <rule id="100256" level="12">
        <decoded_as>web</decoded_as>
        <field name="url" type="pcre2">(?:outputDir|parent|projectPrefix)</field>
        <regex type="pcre2">(?:\.\./|\.\.%2[fF]|\.\.%5[cC]|\.\.\\)</regex>
        <description>CVE-2026-19756: Path traversal attempt against Dromara lamp-cloud code generator (DefGenProjectController)</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>web_application_attack</group>
    </rule>
</group>

This rule should be attached to the Wazuh Apache/HTTP decoder output. If the deployment uses a reverse proxy or API gateway, tune decoded_as accordingly and test against synthetic payloads before enabling in production.

Mitigation & Patch Guidance

Patch status: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and the Dromara project has not responded to the responsible disclosure issue report. The OSV database entry for CVE-2026-19756 lists the package state as unfixed from commit 1d0243a578e4db59d84d29aaf129d5ff4999ba6d.

1. Immediate mitigations (while unpatched):

• Disable or block access to the Code Generator component if it is not essential to business operations. If it is exposed through a separate microservice, remove it from the load balancer or restrict it to an isolated management network.
• Apply strict network access control: allow only trusted administration subnets to reach the application; block internet-facing access to lamp-cloud management consoles entirely.
• Deploy a WAF (e.g., ModSecurity) with rules that reject requests containing ../, ..%2f, ..%5c, or double-encoded variants in outputDir, parent, or projectPrefix parameters.
• Enforce least privilege: revoke low-privileged accounts from roles that can access code generation features; require administrative approval for generation requests.
• Audit existing accounts and sessions for anomalous use of generation endpoints, especially from non-administrative users.

2. Patch/upgrade steps:

• Subscribe to the Dromara lamp-cloud repository and the NVD/OSV feed for CVE-2026-19756 to be notified of any future fix.
• If the project remains unresponsive, consider maintaining an internal fork and applying a patch that validates the three parameters as follows: reject any value containing directory traversal sequences (/\.\./, ..%2f, backslash variants); after concatenation, canonicalize the resulting path (e.g., Java Path.normalize() / File.getCanonicalPath()) and verify the resolved path remains within the configured code-generation base directory; deny otherwise.
• Upgrade to a patched version the moment a release containing the fix is published; until then, treat all versions ≤ 5.10.0 as vulnerable.

3. Long-term hardening:

• Adopt secure file-handling patterns across the codebase: never build filesystem paths directly from user-controlled strings; combine a fixed base directory with sanitized relative components.
• Implement centralized logging of file-generation events and feed the detection rules above into the SOC alerting pipeline.
• Integrate OSV and CVE monitoring into your CI/CD pipeline (the OSV entry 1d0243a578e4db59d84d29aaf129d5ff4999ba6d→unfixed should trigger an inventory flag for any lamp-cloud dependency).
• Regularly review and harden the lamp-cloud service account permissions so that even a successful path traversal yields only low-impact file operations.
• Conduct periodic red-team exercises against the code generator endpoint using the Sigma/Suricata/Splunk detections to validate both exploitability and alert fidelity.

References

1. NVD Entry for CVE-2026-19756 — https://nvd.nist.gov/vuln/detail/CVE-2026-19756
2. CWE-22: Improper Limitation of a Pathname to a Restricted Directory — https://cwe.mitre.org/data/definitions/22.html
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. OSV Vulnerability Entry for CVE-2026-19756 — https://osv.dev/vulnerability/CVE-2026-19756
5. FIRST EPSS API (score reference, 0.00288) — https://www.first.org/epss/

Threat actor campaigns: No known threat actor campaigns or exploitation-in-the-wild evidence was identified in the provided data. CVE-2026-19756 is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability of 0.00288 (21.4th percentile) supports a low but non-zero exploitation likelihood; enterprises should nevertheless prioritize this fix given the public exploit disclosure and the absence of an upstream patch.