PT-2026-20649 · Unknown · Dynamicweb

CVE-2026-2731 · Publicado 2026-02-19 · Atualizado 2026-02-19

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DynamicWeb versions prior to 9.19.7 and prior to 9.20.3 DynamicWeb version 8 (all)

Description A path traversal and content injection issue exists in the 'JobRunnerBackground.aspx' component. This allows unauthenticated attackers to execute code through simple web requests. The issue leads to full system compromise. The vulnerable component is 'JobRunnerBackground.aspx'. The affected API endpoint is 'JobRunnerBackground.aspx'.

Recommendations Update to DynamicWeb version 9.19.7 or later. Update to DynamicWeb version 9.20.3 or later.

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-2731

Produtos afetados

Dynamicweb

Referências · 5

• https://t.me/CVEtracker/45089 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2731 · Nota de Segurança
• https://doc.dynamicweb.dev/documentation/fundamentals/dw10release/security-reports.html#january-19th-2026---unauthenticated-rce-dynamicweb-9-and-dynamicweb-8 · Nota
• https://twitter.com/0dayPublishing/status/2024380930777911433 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2024501264093212912 · Publicação no Twitter