Live › vulnerability › CVE-2022-26352
Go to dashboarddotCMS has an unrestricted file upload flaw in its ContentResource API that lets a request save a dangerous file type outside the intended folder via directory traversal. An attacker who can reach the API can plant a file that runs code on the server, and CISA lists it as actively exploited, with ransomware use noted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| dotCMS dotCMS | vendor | – | – |
| dotcms | vendor | >= 3.0, <= 22.02 | – |
Unknown from the sources.
Apply the dotCMS update per the vendor instructions; the fixed version is not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2022-26352")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.