CVE-2026-91996 Details

A vulnerability exists in lamp-cloud versions through 5.10.0, where the path pattern '/*/anno/**' is whitelisted for anonymous access. This allows unauthenticated attackers to access the server's complete JVM system property map. The vulnerability arises because the code-generator controller exposes an endpoint that matches the whitelisted path, enabling the retrieval of sensitive information such as the JVM classpath, filesystem paths, operating system details, and startup secrets.

Remove the 'getProperties' endpoint from the 'DefGenProjectController' as it serves no legitimate purpose. Additionally, replace the wildcard '/*/anno/**' in the 'IgnoreProperties.baseUri' with explicit paths to prevent unintended controllers from being whitelisted for anonymous access.