dotCMS ContentResource API Directory Traversal Remote Code Execution Vulnerability (CVE-2022-26352) Technical Analysis and Hardening Guide
Executive & SecOps Summary
SECOPS ASSESSMENTdotCMS versions 3.0 through 22.02
Unauthenticated attackers can upload malicious JSP files via directory traversal when anonymous content creation is enabled, leading to full Remote Code Execution (RCE)
Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, upgrade your dotCMS instance to version 22.03 or later. Below is an example of upgrading a Docker-based dotCMS deployment.
# 1. Stop and remove the vulnerable dotCMS container
docker-compose down
# 2. Update the dotCMS image version in docker-compose.yml to a patched release (e.g., 22.03)
sed -i 's/dotcms\/dotcms:22.02/dotcms\/dotcms:22.03/g' docker-compose.yml
# 3. Pull the secure image and restart the services
docker-compose pull
docker-compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure your Web Application Firewall (WAF) or reverse proxy to block requests containing directory traversal sequences in the file upload headers.
# Nginx configuration snippet to block directory traversal attempts in multipart requests
server {
listen 80;
server_name your-dotcms-instance.com;
location ~* /api/content/ {
# Block payloads containing directory traversal sequences in the request body
if ($request_body ~* "filename=.*\.\./") {
return 403 'Access Denied: Directory Traversal Detected';
}
proxy_pass http://dotcms_backend;
}
}3. Log Audit & IoC Verification Commands
Inspect your environment for unauthorized JSP files and review access logs for suspicious activity targeting the ContentResource API.
# 1. Search for recently modified or created JSP files in the web root directory
find /opt/dotcms/dotserver/webapps/ROOT/ -name '*.jsp' -mtime -30 -ls
# 2. Scan access logs for directory traversal patterns targeting the ContentResource endpoint
grep -i 'ContentResource' /opt/dotcms/dotserver/tomcat/logs/localhost_access_log*.txt | grep -E '\.\./|%2e%2e%2f'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists within the ContentResource API of dotCMS due to insufficient sanitization of the filename parameter in multipart form-data upload requests. Because the application fails to strip directory traversal sequences (such as ../), an attacker can manipulate the file path to write uploaded files outside of the designated temporary or asset storage directories.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious HTTP POST request targeting the ContentResource endpoint. By setting the filename parameter in the multipart header to a relative path like ../../../../webapps/ROOT/shell.jsp, the attacker bypasses intended directory boundaries. If anonymous content creation is permitted, no authentication is required to trigger this behavior. The application saves the executable JSP file directly into the web root, allowing the attacker to execute arbitrary system commands by requesting the uploaded JSP file via a standard HTTP request.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and active exploitation documented in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk. Successful exploitation grants the attacker initial access to the underlying container or host operating system, potentially leading to lateral movement, database compromise, ransomware deployment, and complete infrastructure takeover.
Official Vendor Advisories & References
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
Frequently Asked SecOps Questions (CVE-2022-26352)
FAQQ1. How critical is CVE-2022-26352 and is it actively exploited in the wild?
CVE-2022-26352 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 91.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-26352?
Primary impacted vendors include dotcms across dotcms. Scope summary: All dotCMS deployments from version 3.0 up to 22.02 (especially critical if anonymous content creation is enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2022-26352 before patching?
[Mitigation] Immediately upgrade to patched dotCMS versions (22.03 or higher) and disable anonymous content creation APIs if not required Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-26352
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (dotcms)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.