🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2022-26352

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Sep 26, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2022-26352 Scanner

CVE-2022-26352 scanner - Unrestricted File Upload vulnerability in dotCMS

Used 2.7k times · 4.3k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →