CVE-2022-26352
dotCMS Unrestricted Upload of File Vulnerability
Description
CVE-2022-26352 is an unrestricted file upload vulnerability with directory traversal in dotCMS, a popular open-source content management system. The vulnerability exists in the dotCMS ContentResource API, which fails to properly validate uploaded file types and paths, allowing an attacker to upload malicious files with dangerous types and save them outside the intended storage location via directory traversal. Successful exploitation enables remote code execution on the hosting server. CISA has added CVE-2022-26352 to its Known Exploited Vulnerabilities catalog with a confirmed association to ransomware campaigns, and the EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dotcms | dotcms | >= 3.0, <= 22.02 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167365/dotCMS-Shell-Upload.html(Exploit, Third Party Advisory, VDB Entry)
- https://groups.google.com/g/dotcms(Permissions Required, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26352(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2022-26352 exploits an unrestricted file upload weakness in the dotCMS ContentResource API, where uploaded files are not properly validated for type, content, or destination path. This allows an attacker to upload files containing executable code (such as web shells or server-side scripts) that the server will process and execute, bypassing intended content restrictions.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
CWE-22: Path Traversal
The vulnerability also involves a path traversal component, where the uploaded file can be saved outside the intended storage directory by manipulating the file path with directory traversal sequences (e.g., ../). This allows the attacker to place malicious files in server locations where they will be executed.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2022-26352 poses a critical risk to organizations using dotCMS for content management. The vulnerability is remotely exploitable over the network without authentication, requiring no user interaction and involving low attack complexity. By combining unrestricted file upload with directory traversal, an attacker can upload a web shell or other malicious executable to an arbitrary location on the server, achieving remote code execution with the privileges of the dotCMS application process. This can lead to complete server compromise, data exfiltration from the CMS database, defacement of the hosted website, lateral movement within the hosting infrastructure, and deployment of additional malware. The confirmed association with ransomware campaigns significantly amplifies the business impact, as compromised CMS servers often have network access to backend databases and internal systems. With an EPSS score of 94.3% (99th percentile), this vulnerability is among the most actively exploited across all known CVEs.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26352 in the wild and has specifically flagged it as being used in ransomware campaigns. The EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity. The vulnerability is straightforward to exploit — an attacker needs only to send a crafted HTTP request to the ContentResource API endpoint with a malicious file and a traversal path to achieve code execution. Security advisory SI-62 from dotCMS documents the vulnerability, and public exploit information is available in the security community. The combination of unauthenticated access, remote code execution capability, and ransomware association makes this a critical-priority remediation target.
Remediation
- Apply dotCMS security updates immediately: Per the CISA KEV required action, apply updates per vendor instructions as documented in dotCMS security advisory SI-62. Upgrade to the patched dotCMS version that addresses the file upload and path traversal vulnerabilities.
- Review the server for indicators of compromise: Before and after patching, inspect the server's filesystem for unexpected files in web-accessible directories, particularly web shells (JSP, PHP, or other server-side script files) that may have been uploaded through exploitation of this vulnerability.
- Implement Web Application Firewall (WAF) rules: Deploy WAF rules to detect and block file upload requests containing directory traversal sequences (../) and requests attempting to upload executable file types to the ContentResource API.
- Restrict file upload permissions: Configure dotCMS to enforce strict allowlists for uploadable file types, limiting uploads to known-safe content types (images, documents) and blocking executable file extensions.
- Isolate the CMS server: Implement network segmentation to limit the blast radius of a potential compromise, restricting the CMS server's access to backend databases and internal networks to only necessary connections.
Technical Details
CVE-2022-26352 is a combined unrestricted file upload and directory traversal vulnerability in the dotCMS ContentResource API. The API endpoint accepts file uploads as part of content creation and management workflows but fails to perform adequate validation on both the file type and the destination path. An attacker can craft an HTTP multipart upload request that includes a file with a dangerous type (such as a JSP web shell for Java-based servers) and specifies a file path containing directory traversal sequences (../). The server processes the upload without validating that the file type is safe or that the destination path remains within the intended upload directory. As a result, the malicious file is written to an attacker-controlled location on the server's filesystem, such as a web-accessible directory where the server will execute it as a dynamic page. When subsequently accessed via HTTP, the uploaded web shell executes with the permissions of the dotCMS application server process.
Frequently Asked Questions
Is CVE-2022-26352 being actively exploited?
Yes. CISA has confirmed active exploitation and specifically identified CVE-2022-26352 as being used in ransomware campaigns. The EPSS score of 94.3% (99th percentile) indicates near-certain exploitation for exposed instances. Immediate patching is essential.
What products are affected by CVE-2022-26352?
CVE-2022-26352 affects dotCMS, an open-source content management system. The vulnerability is in the ContentResource API and affects versions prior to the security fix documented in dotCMS advisory SI-62. All dotCMS installations with the vulnerable API endpoint accessible are at risk.
How do I fix CVE-2022-26352?
Upgrade dotCMS to the patched version documented in security advisory SI-62. After patching, scan the server for any web shells or suspicious files that may have been uploaded before the fix was applied. Implement WAF rules to block file upload attacks and restrict uploadable file types.
How severe is CVE-2022-26352?
CVE-2022-26352 is a critical severity vulnerability that enables unauthenticated remote code execution through unrestricted file upload combined with directory traversal. Its EPSS score of 94.3% (99th percentile) and confirmed use in ransomware campaigns make it one of the highest-risk vulnerabilities for organizations running dotCMS.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.