CVE-2022-26352
Published 2022-07-17 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2022-26352 is a critical-severity (CVSS 9.8) vulnerability in dotCMS dotCMS. CISA added it to the Known Exploited Vulnerabilities catalog on August 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 15, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly.
All 1 known-exploited dotCMS vulnerabilities →Description
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: dotCMS — dotCMS
Name: dotCMS Unrestricted Upload of File Vulnerability
Date added: 2022-08-25 · Due: 2022-09-15
Required action: Apply updates per vendor instructions.