CVE-2022-26352

CVE-2022-26352 is a critical directory traversal vulnerability in the ContentResource API of dotCMS versions 3.0 through 22.02. It allows unauthenticated attackers to upload arbitrary files, including executable files like .jsp, by crafting a multipart form request with an unsanitized filename, leading to remote code execution (RCE). With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction, resulting in complete compromise of confidentiality, integrity, and availability. This flaw is actively exploited in the wild, notably by North Korean threat actors in ransomware campaigns, and has publicly available exploit modules in Metasploit and Nuclei, along with significant community discussion and media coverage.