CVE-2026-9498

Name of the Vulnerable Software and Affected Versions Dromara lamp-cloud versions prior to 5.6.3

Description Improper neutralization of special elements used in a template engine occurs within the Message Template Handler component. A remote attack is possible by manipulating the DefMsgTemplate.content argument, which affects the GroovyClassLoader.parseClass() function.

Recommendations Update Dromara lamp-cloud to version 5.6.3 or later. As a temporary mitigation, restrict access to the GroovyClassLoader.parseClass() function within the Message Template Handler component.