GHSA-42vg-q6mw-cfh5High

dotCMS allows remote authenticated users to execute arbitrary Java code

Published
May 17, 2022
Last Modified
April 12, 2025

🔗 CVE IDs covered (1)

CVE-2012-1826 →

📋 Description

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

🎯 Affected products1

  • maven/com.dotcms:dotcms:>= 1.9, < 1.9.5.1

🔗 References (8)