{"id":"CVE-2022-26352","kind":"vulnerability","aliases":["CVE-2022-26352"],"related":[],"title":"An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02","description":"An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.","summary":"dotCMS has an unrestricted file upload flaw in its ContentResource API that lets a request save a dangerous file type outside the intended folder via directory traversal. An attacker who can reach the API can plant a file that runs code on the server, and CISA lists it as actively exploited, with ransomware use noted.","severity":"critical","cvss":9.8,"epss":0.91248,"exploited":true,"exploited_at":"2022-08-25T00:00:00+00:00","products":[{"name":"dotCMS dotCMS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dotcms","fixed":[],"affected":">= 3.0, <= 22.02","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotcms","exploited","java","ransomware","runtime","self-hosted"],"not_affected_if":["no-dotcms-instance"],"how_to_check":null,"fix":"Apply the dotCMS update per the vendor instructions; the fixed version is not stated in the sources.","status":"open","published_at":"2022-07-17T22:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:10:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the dotCMS update per the vendor instructions; the fixed version is not stated in the sources.\nUnknown which exact versions are affected.","reach":"internet","impact":"high","summary":"dotCMS has an unrestricted file upload flaw in its ContentResource API that lets a request save a dangerous file type outside the intended folder via directory traversal. An attacker who can reach the API can plant a file that runs code on the server, and CISA lists it as actively exploited, with ransomware use noted.","category":"runtime","who_cares":["dotcms","self-hosted","java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the dotCMS server and can reach its data.","analyst_note":"Find affected version range and fixed build from the dotCMS advisory and the CISA KEV entry; confirm whether authentication is required for the ContentResource upload path.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-dotcms-instance"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2863,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':15A,18A '-26352':16A,19A '22.02':13A,98C '3.0':11A,96C 'activ':80B 'allow':117C,139C 'anonym':133C 'api':8A,41B,64B,93C 'attack':59B,99C,142C 'cisa':76B 'code':71B,158C 'content':134C 'contentresourc':7A,40B,92C 'craft':101C 'creation':135C 'cve':14A,17A 'danger':48B 'directori':56B,118C 'discov':4A,89C 'dotcm':10A,23B,31B,95C 'dotcms':20A,21A,22A 'enabl':137C 'execut':146C,159C 'exploit':24B,81B 'file':35B,49B,68B,109C,123C,147C,152C 'filenam':111C 'flaw':37B 'folder':54B 'form':104C 'host':30B 'initi':114C 'intend':53B,129C 'issu':2A,87C 'java':25B 'jsp':151C 'lead':155C 'let':43B 'list':77B 'locat':131C 'multipart':103C 'note':85B 'outsid':51B,126C 'plant':66B 'post':107C 'ransomwar':26B,83B 'reach':62B 'remot':157C 'request':45B,105C 'run':70B 'runtim':27B 'sanit':115C 'save':46B,125C 'self':29B 'self-host':28B 'server':74B 'storag':130C 'travers':57B,119C 'type':50B 'unauthent':141C 'unrestrict':34B 'upload':36B,144C 'use':84B 'via':55B 'whose':110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-07-17T22:15:08+00:00","kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26352","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26352","severity":null,"published_at":"2022-08-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2022-26352","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-26352","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-26352","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26352","severity":null,"published_at":"2022-07-17T22:15:08+00:00","modified_at":"2026-06-17T04:35:02+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}