CVE-2026-91996: Dromara Lamp-Cloud

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

Affected products

• Dromara Lamp-Cloud: up to and including 5.10.0

Published 2026-09-15. Last modified 2026-09-22.