---
id: "CVE-2022-26352"
kind: "vulnerability"
aliases: ["CVE-2022-26352"]
title: "An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02"
severity: "critical"
cvss: 9.8
epss: 0.91248
exploited: true
status: "open"
category: "runtime"
products: [{"name": "dotCMS dotCMS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "dotcms", "fixed": [], "affected": ">= 3.0, <= 22.02", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dotcms", "exploited", "java", "ransomware", "runtime", "self-hosted"]
not_affected_if: ["no-dotcms-instance"]
published_at: "2022-07-17T22:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26352", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26352", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26352", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02

dotCMS has an unrestricted file upload flaw in its ContentResource API that lets a request save a dangerous file type outside the intended folder via directory traversal. An attacker who can reach the API can plant a file that runs code on the server, and CISA lists it as actively exploited, with ransomware use noted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dotCMS dotCMS affected ? fixed ?
- vendor:dotcms affected >= 3.0, <= 22.02 fixed ?

## Fix

Apply the dotCMS update per the vendor instructions; the fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26352
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-26352
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26352

## From the sources

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_