Loading story…
A critical pre-authentication remote-code-execution vulnerability, CVE-2022-26352, affects dotCMS instances through directory traversal in the file-upload process. An unauthenticated attacker can upload an arbitrary JSP file into Apache Tomcat’s web root and invoke it to execute operating-system commands.
The issue was confirmed in dotCMS 22.01 and earlier under the default configuration; version 22.02 was identified as potentially affected but was not confirmed. Assetnote Security Research Team reported the flaw to DotCMS in February 2022, and the vendor deployed fixes before public disclosure. Organizations running affected releases should verify that vendor remediations are applied and investigate exposed dotCMS instances for unauthorized JSP files in Tomcat web directories.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Assetnote notified DotCMS that it would publish details of the vulnerability under its coordinated-disclosure process.
DotCMS provided Assetnote with details of deployed fixes and its remediation progress for CVE-2022-26352.
DotCMS responded to Assetnote and asked who would file the CVE; Assetnote asked DotCMS to file it.
Assetnote Security Research Team disclosed the directory-traversal file-upload vulnerability, later identified as CVE-2022-26352, to DotCMS. The flaw could allow unauthenticated attackers to upload a JSP file into Tomcat's web root and execute operating-system commands.
During research against a large bank's hardened dotCMS deployment, Hussein Daher and Shubham Shah could not write to the Tomcat webroot but used CVE-2022-26352 to overwrite JavaScript assets served by the application. They reported that more than 100 of the bank's assets were affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat maintainers disclosed and patched **CVE-2024-50379**, a critical remote code execution flaw tied to the default servlet when write access is enabled. The bug is a **TOCTOU race condition** during JSP compilation that can let an unauthenticated attacker upload specially crafted files and execute code on vulnerable servers under specific conditions. The issue affects Tomcat `11.0.x` before `11.0.2`, `10.1.x` before `10.1.34`, and `9.0.x` before `9.0.98`. Advisories also addressed **CVE-2024-54677**, a separate denial-of-service issue in Tomcat sample web applications caused by unrestricted total upload size. Defenders were urged to upgrade immediately to `11.0.2`, `10.1.34`, or `9.0.98`, and to review deployments that expose write-enabled default servlet functionality or retain sample applications in production.
Jul 24, 2026
A high-severity vulnerability tracked as **CVE-2026-16337** affects **dotCMS** versions `21.02` through `26.06.22-03`, allowing a low-privileged authenticated backend user to escalate privileges and achieve remote code execution. The issue stems from improper authorization in the `ToolGroupResource` layout-assignment endpoints and `RoleAjax` REST/DWR methods, which let a user self-assign the administrative Settings layout, grant themselves the **CMS Administrator** role, and then upload a crafted OSGi bundle whose `BundleActivator` can run arbitrary shell commands on the host. dotCMS addressed the chain in core pull request **#36344** by enforcing **CMS Administrator** checks on `ToolGroupResource._addtouser`, `ToolGroupResource._removefromuser`, `RoleAjax.addUserToRole`, and `RoleAjax.removeUsersFromRole`, while preserving limited self-service behavior for the `gettingstarted` onboarding layout. A follow-up hardening change moved authorization checks ahead of `loadUserById` calls to block unauthorized requests before database access, and unit tests were added for the new admin gates and onboarding exceptions.
Jul 21, 2026
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026