# CVE-2022-26352

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2022-26352
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-08-25; CISA due date 2022-09-15; known ransomware use
- EPSS: 91.25% (percentile 99.8)
- Public exploit code: 1 Metasploit module · 1 Nuclei template
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2023-12-22)
- Published: 2022-07-17

## Affected

- dotcms:dotcms

## References

- [other] https://groups.google.com/g/dotcms
- [other] http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26352

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.