CVE‑2022‑26352: dotCMS ContentResource API Unrestricted File Upload Leads to Remote Code Execution
What It Is — dotCMS’s ContentResource API permits unrestricted file uploads of dangerous types, enabling directory‑traversal so that an attacker‑supplied file can be written outside the intended storage path.
Exploitability — Publicly disclosed; proof‑of‑concept code exists and remote code execution (RCE) can be achieved without authentication. CVSS v3.1 base score 9.8 (Critical).
Affected Products — dotCMS (all versions prior to the vendor‑released fix; see CISA KEV advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping and evidence collection to prove that file‑handling safeguards are in place across development and runtime environments.
- A single control gap (lack of upload validation) can invalidate audit evidence for multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) that require “secure configuration management” and “protective monitoring.”
- Enterprises increasingly demand a defensible audit trail showing that file‑type restrictions, directory‑access controls, and logging are enforced and continuously verified.
Recommended Actions
- Apply the vendor‑provided patch for CVE‑2022‑26352 immediately.
- Enforce strict file‑type whitelisting and path‑validation in the ContentResource API.
- Enable detailed logging of all upload events and monitor for anomalous file paths or extensions.
- Capture remediation evidence (patch version, configuration snapshots, log excerpts) for audit readiness.
Source: CISA KEV Advisory