Actively exploited in the wild
dotCMS Unrestricted Upload of File Vulnerability
dotCMS - dotCMS · Listed in the CISA KEV since 2022-08-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-26352
CriticalCVSS 9.8KEVSummary
In dotCMS 3.0 through 22.02, the ContentResource API has a vulnerability that allows an attacker to bypass filename sanitization in a multipart request. This enables directory traversal, saving files outside the intended location. If anonymous content creation is enabled, an unauthenticated attacker can upload an executable file such as .jsp, leading to remote code execution.
Risk Assessment
Risk of remote code execution on the dotCMS server, potentially leading to full system compromise and data breach.
Recommendation
Update dotCMS to a patched version and disable anonymous content creation if not required.
Other vulnerabilities in dotCMS
See all- CVE-2017-11466High
In dotCMS version 4.1.1, there is an arbitrary file upload vulnerability that allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter. This can lead to arbitrary code execution by requesting the .jsp file at an /assets URI.
- CVE-2016-8908High
SQL injection vulnerability in the 'Site Browser > HTML pages' screen in dotCMS before version 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
- CVE-2016-8907High
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Content Types > Content Types' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
- CVE-2016-8906High
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Links pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
- CVE-2016-8904High
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Containers pages' screen. This allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
- CVE-2016-8903High
In dotCMS before version 3.3.1, there is an SQL injection vulnerability in the 'Site Browser > Templates pages' screen that allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
- CVE-2016-8600High
In dotCMS version 3.2.1, an attacker can load captcha once, fill it with the correct value, and then this correct value will be accepted for forms with captcha check later.
- CVE-2016-4803High
CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
- CVE-2026-16337Critical
Vulnerability in dotCMS (versions 21.02 through 26.06.22-03) in ToolGroupResource and RoleAjax REST/DWR endpoints. A low-privileged authenticated backend user can self-assign the CMS Administrator role and achieve remote code execution via a crafted OSGi bundle upload.
- CVE-2017-5344Critical
An issue was discovered in dotCMS through 3.6.1 related to the findChildrenByFilter() function, which performs string interpolation and direct SQL query execution. Although SQL quote escaping and a keyword blacklist were implemented, they can be bypassed for the q and inode parameters, leading to potential SQL injection attacks.
Original NVD description (English source)
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.