CVE-2022-26352
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
CISA Known Exploited Vulnerability
Vendor / Product
dotCMS — dotCMS
Date Added
2022-08-25
Remediation Due
2022-09-15
Ransomware Use
CONFIRMED
https://www.dotcms.com/security/SI-62; https://nvd.nist.gov/vuln/detail/CVE-2022-26352