Tag

#dotcms

1 post tagged #dotcms.

Analysis · May 20, 2026 · Colten Anderson

An uploaded filename is attacker input. dotCMS forgot, and got a webshell.

CVE-2022-26352 is a directory traversal in dotCMS's upload API: the filename in a multipart request wasn't sanitized, so '../' sequences let an attacker write a JSP webshell to a web-reachable directory. With anonymous content creation on, that's unauthenticated RCE.