CVE-2022-26352: dotCMS ContentResource API path traversal enables unauthenticated file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation per CISA KEV with ransomware use, and very high EPSS make this an urgent patch-first issue.

What it is

The ContentResource API in dotCMS 3.0 through 22.02 fails to sanitize the filename in multipart form uploads, allowing directory traversal that writes files outside the intended storage location. When anonymous content creation is enabled, an unauthenticated attacker can upload an executable file such as a .jsp and achieve remote code execution.

Impact

An attacker can write arbitrary files to attacker-chosen paths on the server and, by uploading a web-accessible executable, run code as the dotCMS process, leading to full compromise of the application and host.

Attack surface

Reachable over the network through the ContentResource API via a crafted multipart form request; the CVSS vector indicates no privileges or user interaction required, though the description notes unauthenticated exploitation depends on anonymous content creation being enabled.

Exploitation

Listed in CISA KEV with a 2022-09-15 remediation due date and flagged for known ransomware campaign use, and EPSS is 0.91553 (99.8th percentile); public exploit code is referenced on Packet Storm.

What to do

• Upgrade dotCMS to a version later than 22.02 per vendor instructions (KEV required action).
• Disable anonymous content creation if it is not operationally required.
• Restrict write permissions on the web root and content storage directories so uploaded files cannot be executed.
• Block or inspect multipart uploads containing path traversal sequences or executable extensions at the reverse proxy/WAF.
• Verify no unauthorized files (especially .jsp) exist in web-accessible directories after patching.

Detection

• Monitor ContentResource API multipart POST requests for filenames containing ../ or absolute paths.
• Alert on newly created .jsp or other executable files in web-accessible directories.
• Audit dotCMS logs for file uploads written outside expected storage paths.
• Watch for unexpected child processes or outbound connections originating from the dotCMS server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.