# Advisory: DotCMS Remote Code Execution (CVE-2022-26352)

Pre-auth directory traversal in DotCMS file upload lets attacker write a JSP into Tomcat ROOT, achieving remote command execution.

- Payout: Research
- Severity: critical
- Program: DotCMS
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-26352
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-dotcms-remote-code-execution-cve-2022-26352
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-dotcms-remote-code-execution-cve-2022-26352
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:java technique:source-review vuln:file-upload vuln:path-traversal vuln:rce

**Target:** POST /api/content/ multipart file upload endpoint
**Root cause:** The content upload endpoint uses the attacker-supplied multipart filename without sanitizing path traversal sequences, so the file is written outside the intended upload directory.
**Steps:**
1. Send `POST /api/content/` with `Content-Type: multipart/form-data`
2. Set filename to `../../../../../../../../../srv/dotserver/tomcat-9.0.41/webapps/ROOT/html/js/dojo/a.jsp`
3. Body contains a JSP webshell reading `cmd` parameter and calling `Runtime.getRuntime().exec`
4. Request `GET /html/js/dojo/a.jsp?cmd=<command>` to execute commands
**Exploitation:** Unauthenticated attacker uploads a JSP webshell via traversal filename into Tomcat's webapps/ROOT, then invokes it over HTTP to run arbitrary OS commands.
**Insight:** Multipart upload handlers that trust the client filename are prime traversal targets; check whether the write path lands inside a web-served directory so a JSP/PHP drop becomes RCE.