Is CVE-2022-26352 actively exploited?

Yes. CVE-2022-26352 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-26352 be exploited remotely?

The attack vector of CVE-2022-26352 has not been classified yet.

What is the CVSS score of CVE-2022-26352?

CVE-2022-26352 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-26352

HIGHCISA KEVIN THE WILD

CVE-2022-26352

Published: August 25, 2022

EPSS:94.34%probability of exploitation in 30 daysPercentile:100.0th

Official Description

dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.

NVD Source

CISA KEV Advisory

dotCMS Unrestricted Upload of File Vulnerability

Added to KEV: 2022-08-25Federal patch deadline: 2022-09-15⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

dotCMS ContentResource API contains a vulnerability allowing unrestricted file uploads with dangerous types, leading to directory traversal and remote code execution. The high EPSS score of 0.94337 indicates a very high likelihood of exploitation, making this a critical issue. This vulnerability is confirmed as exploited by CISA.

This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog. The ability to upload dangerous file types and achieve directory traversal points to remote exploitability.

Recommended Action

Apply the latest security patches for dotCMS to address the unrestricted file upload vulnerability. Implement strict validation for file uploads and ensure files are stored in secure, isolated locations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-26352 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-26352 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.