CVE-2026-91996lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

Descripción

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• Researcher write-up third-party-advisoryexploit
• IgnoreProperties.java anonymous-path whitelist technical-description
• DefGenProjectController.getProperties technical-description
• https://github.com/dromara/lamp-cloud product
• VulnCheck Advisory: lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint third-party-advisory