PT-2026-21673 · Dotcms · Dotcms

Publicado 2026-02-24 · Atualizado 2026-03-03 · CVE-2025-11165

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS (affected versions not specified)

Description A security issue exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and reinitializing its Uberspect, an attacker can remove the introspector.restrict.classes and introspector.restrict.packages protections. Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process. The affected API endpoints and variables are not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-11165

Produtos afetados

Dotcms

Referências · 8

• https://t.me/CVEtracker/45586 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2026265016324747493 · Publicação no Twitter
• https://t.me/cveNotify/153867 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-11165 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-11165 · Nota de Segurança
• https://t.me/cveNotify/152984 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2026233211949396205 · Publicação no Twitter
• https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-74 · Aviso do Fabricante