Critical severity · published Jul 17, 2022
CVE-2022-26352
dotCMS Unrestricted Upload of File Vulnerability
RansomwareIn wildKEV
9.8
CVSS
91.2%
EPSS
Yes
On KEV
Description
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)91.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 25, 2022
Federal remediation dueSep 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
DO
Dotcms · Dotcms
3.0 through 22.02 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26352
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://groups.google.com/g/dotcms
x_refsource_MISC
http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
More from Dotcms
9.9
CVE-2025-11165
A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package…
9.8
CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component…
9.8
CVE-2020-6754
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control
9.8
CVE-2017-5344
An issue was discovered in dotCMS through 3.6.1
9.8
CVE-2016-2355
SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1