CVE-2026-2731

Critical

Published: 19/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests.

Risk Assessment

An attacker can achieve remote code execution, leading to full server and data compromise. This may result in takeover of the application.

Recommendation

Update DynamicWeb to version 9.19.7 or 9.20.3 (or later) immediately and restrict access to JobRunnerBackground.aspx.

Original NVD description (English source)

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests