CVE-2026-19757

Name of the Vulnerable Software and Affected Versions Dromara lamp-cloud versions prior to 5.10.1

Description A path traversal issue exists in the File-Upload Controller component within the FileAnyoneController.java file. A remote attacker can exploit this by manipulating the bucket or bizType arguments, allowing them to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the FileAnyoneController.java file or avoid using the bucket and bizType arguments in the File-Upload Controller until a patch is available.