ACTIVELY EXPLOITED
CVE-2022-26352: dotCMS Unrestricted Upload of File Vulnerability
| Vendor | dotCMS |
|---|---|
| Product | dotCMS |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Aug 2022 |
| CISA federal deadline | 15 Sep 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-138, CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.