CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

Description

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• Researcher write-up third-party-advisoryexploit
• IgnoreProperties.java anonymous-path whitelist technical-description
• DefGenProjectController.getProperties technical-description
• https://github.com/dromara/lamp-cloud product
• VulnCheck Advisory: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint third-party-advisory