Loading story…
A high-severity vulnerability tracked as CVE-2026-16337 affects dotCMS versions 21.02 through 26.06.22-03, allowing a low-privileged authenticated backend user to escalate privileges and achieve remote code execution. The issue stems from improper authorization in the ToolGroupResource layout-assignment endpoints and RoleAjax REST/DWR methods, which let a user self-assign the administrative Settings layout, grant themselves the CMS Administrator role, and then upload a crafted OSGi bundle whose BundleActivator can run arbitrary shell commands on the host.
dotCMS addressed the chain in core pull request #36344 by enforcing CMS Administrator checks on ToolGroupResource._addtouser, ToolGroupResource._removefromuser, RoleAjax.addUserToRole, and RoleAjax.removeUsersFromRole, while preserving limited self-service behavior for the gettingstarted onboarding layout. A follow-up hardening change moved authorization checks ahead of loadUserById calls to block unauthorized requests before database access, and unit tests were added for the new admin gates and onboarding exceptions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry was published for CVE-2026-16337, describing an improper authorization vulnerability in dotCMS versions 21.02 through 26.06.22-03 that lets a low-privileged authenticated backend user escalate to CMS Administrator and ultimately execute arbitrary shell commands.
The security pull request adding CMS Administrator checks to the affected layout-assignment and role-grant endpoints, along with related hardening and onboarding-layout protections, was merged into the main branch.
dotCMS published pull request #36344 describing fixes for two authorization flaws in ToolGroupResource and RoleAjax that could be chained by an authenticated backend user to gain CMS Administrator privileges and achieve remote code execution via OSGi bundle upload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical pre-authentication remote-code-execution vulnerability, **CVE-2022-26352**, affects dotCMS instances through directory traversal in the file-upload process. An unauthenticated attacker can upload an arbitrary JSP file into Apache Tomcat’s web root and invoke it to execute operating-system commands. The issue was confirmed in dotCMS **22.01 and earlier** under the default configuration; version 22.02 was identified as potentially affected but was not confirmed. Assetnote Security Research Team reported the flaw to DotCMS in February 2022, and the vendor deployed fixes before public disclosure. Organizations running affected releases should verify that vendor remediations are applied and investigate exposed dotCMS instances for unauthorized JSP files in Tomcat web directories.
Sep 3, 2026
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026
baserCMS disclosed and patched an OS command injection vulnerability in its update functionality that allowed an authenticated administrator to execute arbitrary operating system commands on the underlying server. The issue, tracked as **`CVE-2026-30877`** and **`CVE-2026-21861`**, affects baserCMS versions prior to **`5.2.3`** and stems from insufficient validation of user-controlled input passed to the update process, including unsafe handling around `exec()`. The vulnerability is classified as **`CWE-78`** and carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`**, reflecting high impact to confidentiality, integrity, and availability despite requiring administrator privileges. baserCMS addressed the flaw in version **`5.2.3`**, with public references including the vendor security notice, the 5.2.3 release information, and a GitHub security advisory.
Jun 29, 2026