dotCMS vulnerabilities
We track 7 vulnerabilities in dotCMS products across 3 products. 7 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 20, 2026.
Latest dotCMS vulnerabilities
- 9.4 Critical severity
dotCMS: Improper Privilege Management
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Admin
- 10.0 Critical severity
dotCMS Core: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attac
- 9.9 Critical severity
dotCMS: Improper Neutralization of Special Elements used in an SQL Command
A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity eng
- 9.4 Critical severity
dotCMS Cloud Services (dCS): Improper Neutralization of Special Elements used in an SQL Command
dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys. The vulnerability was t
- 9.9 Critical severity
dotCMS core: Incorrect Authorization
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that would and should be available to admins who possess "Sign In
- 8.8 High severity
Dotcms: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.
- 9.8 Critical severity
dotCMS Unrestricted Upload of File Exploited
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the in