CVE-2022-26352

The ContentResource API in dotCMS 3.0 through 22.02 accepts multipart form uploads without sanitizing the submitted filename, allowing directory traversal so the uploaded file is written outside the intended storage location. An attacker triggers this by sending a crafted multipart POST request with traversal sequences embedded in the filename. When anonymous content creation is enabled, the flaw permits a fully unauthenticated attacker to upload an executable file such as a .jsp webshell and achieve remote code execution on the server. All dotCMS deployments running affected versions are exposed, with the highest risk on instances that allow anonymous content creation and expose the ContentResource API to the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25 with known ransomware use, it carries a 91.6% EPSS probability of exploitation, and a public proof of concept is available.

What to do: Upgrade every dotCMS deployment in the 3.0–22.02 range to a fixed release per vendor instructions (any version beyond the affected range, e.g., 22.03 or later, or the vendor's patched LTS branch). If patching must wait, disable anonymous content creation, restrict the upload path so files cannot be written into web-executable directories, and audit the web root for unexpected .jsp files. Review access logs for multipart POSTs to the ContentResource API containing traversal sequences in filenames, and confirm remediation via CISA's required-action guidance.