{"id":"CVE-2022-26352","published":"2022-07-17T22:15:08Z","modified":"2026-06-17T04:35:02Z","title":"dotCMS Unrestricted Upload of File Vulnerability","vendor":"dotCMS","product":"dotCMS","tier":"core","eol":null,"description":{"text":"An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"The dotCMS product's ContentResource API (versions 3.0 through 22.02) fails to sanitize filenames in multipart form uploads, allowing a crafted request to write files outside the intended storage directory via directory traversal. An unauthenticated remote attacker can exploit this without user interaction when anonymous content creation is enabled, uploading an executable file such as a .jsp page that can lead to remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91248,"percentile":0.99809,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.dotcms.com/security/SI-62;  https://nvd.nist.gov/vuln/detail/CVE-2022-26352","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-05-18","exploitedFirstSeen":"2022-05-18","ransomware":true,"evidence":[{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/","date":"2022-07-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-25"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/","date":"2023-01-12"},{"url":"https://www.group-ib.com/resources/research-hub/hi-tech-crime-trends-2022/","date":"2023-01-17"},{"url":"https://www.prio-n.com/a-year-in-review-2022-100-vulnerabilities-you-should-prioritize/","date":"2023-02-02"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2023/03/24/apt-attacks-on-industrial-organizations-in-h2-2022/","date":"2023-03-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-26352","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2022-26352","date":"2023-12-05"}],"evidenceTotal":696,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-138","name":"Improper Neutralization of Special Elements"}],"references":[{"url":"http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://groups.google.com/g/dotcms","tags":["Permissions Required","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://groups.google.com/g/dotcms","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26352","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated multipart upload to public web endpoint","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Attackers can craft a multipart form request to post a file","start":80,"end":139}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploads executable file to target system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an unauthenticated attacker to upload an executable file","start":332,"end":395}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-30911","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30911","exploited":true,"exploitedSince":"2022-08-25","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"DotCMS RCE via Arbitrary File Upload.","module":"exploit/multi/http/dotcms_file_upload_rce","type":"exploit","disclosureDate":"2022-05-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/dotcms_file_upload_rce.rb"}],"nuclei":[{"id":"CVE-2022-26352","name":"DotCMS - Arbitrary File Upload","severity":"critical","path":"http/cves/2022/CVE-2022-26352.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26352.yaml"}],"first":{"date":"2022-05-03","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/dotcms_file_upload_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1105"],"provenance":"ai"}],"timeline":[{"date":"2022-05-03","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/dotcms_file_upload_rce.rb","provenance":"source"},{"date":"2022-05-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","provenance":"source"},{"date":"2022-07-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26352","provenance":"source"},{"date":"2022-08-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-30911","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":39},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1627 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}