CVE-2026-19758

Executive Summary

CVE-2026-19758 is a path traversal vulnerability affecting dromara lamp-cloud, an open-source Java-based microservices development platform, in all versions up to and including 5.10.0. The flaw resides in the chunk-check endpoint, implemented in the FileChunkController.java file, where an attacker can manipulate the Name argument to traverse directories outside the intended upload directory. The vulnerability is remotely exploitable without authentication (CVSS 7.3, High severity), and public exploit disclosure has already occurred, increasing the urgency for organizations running affected versions to implement mitigations. No vendor patch is currently available, and the project maintainers have not responded to the initial disclosure.

Technical Analysis

CVE-2026-19758 is a classic path traversal vulnerability (CWE-22) located in the file-upload handling mechanism of the lamp-cloud platform. The affected component is FileChunkController.java, which exposes the chunk-check endpoint used during the multi-part file upload process — a common pattern for uploading large files in chunks to cloud-based storage systems.

The vulnerability mechanism is rooted in insufficient validation of user-supplied input passed to the Name argument within the endpoint. When a client initiates a chunk-upload session, the application processes metadata about the file being uploaded, including a user-controlled name parameter. This value is subsequently used in constructing filesystem paths for storing incoming chunks. Failure to sanitize this input — specifically, failure to strip or reject path traversal sequences such as ../, absolute path references, or encoded variants (e.g., %2e%2e%2f) — allows an attacker to manipulate the resolved path to point outside the designated upload directory.

The attack is entirely client-side driven: the HTTP request to the chunk-check endpoint carries the malicious Name value, and the server-side code merely concatenates or resolves this value against a base directory without proper canonicalization checks. Because the endpoint does not require authentication (per the CVSS vector: PR:N), any unauthenticated remote attacker who can reach the service can trigger the vulnerable code path.

Launched against a default installation, this flaw permits writing arbitrary content — file chunks — to arbitrary locations on the filesystem, subject to the permissions of the process running the lamp-cloud application (typically a dedicated system user). While the NVD description does not specify the operating system or default privilege level, path traversal in file-upload components typically enables an attacker to overwrite existing files (including JSP/Java class files, configuration files, or cron jobs) or create new ones in directories such as the web root, leading to remote code execution in many real-world scenarios.

The core weakness aligns with OWASP's guidance on secure file upload handling: never trust user-supplied filenames without canonicalizing and verifying the resulting path remains within an allowed root directory. The public disclosure of the issue, combined with the lack of vendor response, means the technical details of the vulnerable code path are likely available to threat actors actively scanning the internet for exposed instances.

Exploitation Scenarios

Given the public disclosure and unpatched status, the following attack chain is realistic, though note that no public PoC exploit is currently confirmed. The chain is inferred from the vulnerability class and the public disclosure language.

Step 1: Reconnaissance and Target Identification
An attacker scans the internet for exposed lamp-cloud administrative interfaces or API endpoints. Default deployment patterns may place the platform behind a reverse proxy or expose it directly on standard HTTP/HTTPS ports. Shodan-style queries using known service banners (e.g., "lamp-cloud" in the response title or body) can identify candidate targets. The chunk-check endpoint is likely reachable under a predictable API route such as /file/chunk-check or similar RESTful path, though this is not confirmed by the NVD description.

Step 2: Vulnerability Trigger
The attacker crafts a request to the chunk-check endpoint containing a Name parameter with path traversal payload. The payload could take the form of ../../../../etc/cron.d/evil or an absolute path such as /var/www/html/webshell.jsp, depending on the target's filesystem layout and the upload destination directory depth. The malicious request is sent via HTTPS POST, with the traversal sequence embedded in the form data or JSON body.

Step 3: Payload Execution
At the vulnerability-class level, the attacker abuses the application's failure to sanitize the Name input. The server resolves the provided path outside the intended upload directory and writes the file chunk(s) to the specified location. For code execution, an attacker could write a web shell into the web application's document root (if writable by the process) and then invoke it via a standard HTTP GET/POST request, achieving arbitrary command execution under the application's service account.

Step 4: Post-Exploitation Impact
Successful exploitation yields the ability to read (via partial overwrite or by abusing the chunk-read functionality) and write arbitrary files. This can lead to:

• Remote Code Execution (RCE): Overwriting JSP/Java class files or deploying web shells.
• Privilege Escalation: Modifying cron jobs or systemd units if running with sufficient privileges, or writing SSH keys to the authorized_keys file of the service user.
• Data Exfiltration or Destruction: Reading sensitive configuration files (e.g., database credentials, API secrets) and overwriting critical application data.

Note: No public PoC is confirmed at this time; the attack chain is inferred from the vulnerability class and associated public disclosure details. The high CVSS accessibility score (AV:N, PR:N) indicates that any successful exploit attempt will be entirely remote and unauthenticated.

Impact Assessment

• Confidentiality Impact (Low): An attacker can read arbitrary files on the host filesystem if the vulnerable code path allows read access (e.g., through the chunk-check response or subsequent file retrieval endpoints). At a minimum, the attacker may exfiltrate configuration files containing sensitive credentials.
• Integrity Impact (Low): The attacker can overwrite or create files in arbitrary locations, subject to filesystem permissions. This includes web application source files, configuration, and potentially cron entries.
• Availability Impact (Low): Targeted file corruption could degrade application functionality, and full filesystem writes could exhaust disk space, causing denial of service.

Affected Systems: Any deployment of dromara lamp-cloud version 5.10.0 or earlier that exposes the chunk-check endpoint to untrusted networks. This includes internet-facing deployments and any internal systems accessible to untrusted users.

Blast Radius: The platform is a microservices development framework, meaning affected installs may underpin multiple business-critical services. Successful exploitation of the host could compromise the entire application cluster's underlying infrastructure, given that path traversal often serves as a foothold for RCE.

Overall Severity: High (CVSS 7.3). While individual confidentiality, integrity, and availability impacts are each rated Low, the network accessibility, low attack complexity, and lack of required privileges elevate the overall severity. The lack of a patch significantly increases real-world risk.

Detection Guidance

The following detection content targets the exploitation of the path traversal flaw and assumes basic visibility into HTTP traffic and host-level filesystem events.

Sigma Rule

title: Lamp-Cloud Chunk-Check Path Traversal Attempt
id: 6f8a9c15-8d4e-4b1a-9d83-7c1e74f53a21
status: experimental
description: Detects path traversal patterns in the chunk-check endpoint Name parameter of dromara lamp-cloud.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19758
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: generic
    definition: 'HTTP access logs from a reverse proxy or web server fronting lamp-cloud.'
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'chunk-check'
        cs-uri-query|contains|all:
            - 'Name='
            - '..%2f'
            - '..%5c'
            - '..%252f'
    filter_known_good:
        cs-uri-query|contains:
            - 'Name=testfile.txt'
    condition: selection and not filter_known_good
level: high
falsepositives:
    - Legitimate file uploads with unusual but valid filenames containing encoded characters.
tags:
    - attack.t1190
    - cve.2026.19758
    - cwe.22

YARA Rule

rule CVE_2026_19758_LampCloud_PathTraversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal payloads targeting the lamp-cloud chunk-check endpoint"
        date = "2026-01-01"
        cve = "CVE-2026-19758"
        severity = "high"
    strings:
        $s1 = "chunk-check" ascii wide nocase
        $s2 = "Name=" ascii wide nocase
        $pattern1 = "../" ascii
        $pattern2 = "..%2f" ascii nocase
        $pattern3 = "..%5c" ascii nocase
        $pattern4 = "/../../" ascii
        $pattern5 = "..\\..\\" ascii
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10KB
        and any of ($s*) and 2 of ($pattern*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Lamp-Cloud Chunk-Check Path Traversal Attempt (CVE-2026-19758)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"chunk-check"; http.client_body; content:"Name="; http.client_body; pcre:"/Name=[^&]*?(?:\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f)/i"; classtype:attempted-admin; sid:202619758; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_19758;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [http where request.method == "POST" and request.uri contains "chunk-check" and
   url.query contains "Name="]
  /* Check for traversal sequences in the query or body */
  [http where (url.query regex~ ".*(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f).*" or
               request.body.content regex~ ".*(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f).*")]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| regex uri="chunk-check"
| regex  _raw="Name=[^&\s]*(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f)"
| table _time, src_ip, uri, http_user_agent, status
| sort - _time

Wazuh OSSEC Rule

<group name="lamp-cloud,">
  <rule id="446054" level="15">
    <decoded>HTTP</decoded>
    <match>chunk-check</match>
    <regex>Name=.*(\.\./|\.\.%2f|\.\.%5c|%2e%2e%2f)</regex>
    <description>CVE-2026-19758: Possible path traversal attempt on lamp-cloud chunk-check endpoint.</description>
    <group>attack.t1190,cwe.22,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence from any tracked source. The vendor has not responded to the disclosure report.

1. Immediate Mitigations

   • Disable or restrict access: If the chunk-check endpoint is not essential for current business workflows, disable the file-upload feature entirely or block access to the endpoint at the reverse proxy or Web Application Firewall (WAF) layer.
   • Network-level access control: Restrict access to the lamp-cloud administrative interface and API paths to trusted IP ranges only. Use VPN or bastion hosts where possible.
   • Input validation at the proxy: Deploy a WAF rule that blocks any request to the chunk-check endpoint containing traversal sequences (e.g., ../, encoded variants) in the Name parameter or anywhere in the request body/query string.
   • Filesystem hardening: Ensure the lamp-cloud service runs under an unprivileged system account with write access limited strictly to the designated upload directory. Deny write access to the web root, /etc, /var/spool/cron, and other sensitive system paths.

2. Patch/Upgrade Steps

   • No official patch is available. Monitor the lamp-cloud GitHub repository and official channels for a security release. The project was notified via an issue report but has not responded.
   • Consider downgrading/alternative versions only if a newer or older version is verified to not contain the vulnerable code path — this is not confirmed at this time.
   • Apply vendor notification pressure: If lamp-cloud is critical to your environment, consider reaching out to the maintainers through public channels to accelerate a fix.

3. Long-Term Hardening

   • Code review and custom hardening: If you have the ability to fork and maintain the code, implement proper path canonicalization and validation (e.g., using java.nio.file.Path.normalize() and checking the resolved path starts with the expected base directory) in the FileChunkController.java file.
   • Implement defense-in-depth: Deploy runtime application security protection; monitor filesystem integrity on the application host(s) using file integrity monitoring tools (e.g., OSSEC, Tripwire) to detect unauthorized file writes.
   • Least-privilege architecture: Run the application in a container or sandbox with a read-only root filesystem and a tightly constrained upload directory mounted as a volume.
   • Incident readiness: Prepare a detection-and-response playbook based on the Sigma, YARA, and other detection rules above. Ensure logs are centralized and retained for forensic analysis.
   • Continuous monitoring: Regularly review the vendor repository for commits addressing path traversal and apply the fix as soon as it is released.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19758
• CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• dromara lamp-cloud GitHub Repository: https://github.com/dromara/lamp-cloud (monitor for patch releases)
• OWASP File Upload Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

Threat Actor Note: As of this writing, there is no publicly confirmed instance of exploitation in the wild, nor are any specific threat actor campaigns associated with this CVE. However, the public disclosure of the vulnerability combined with a lack of vendor response presents a high-risk window for opportunistic exploitation. Security teams should assume active scanning for exposed instances is underway or imminent.