PT-2026-20649 · Unknown · Dynamicweb

Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-2731

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DynamicWeb versions prior to 9.19.7 and prior to 9.20.3 DynamicWeb version 8 (all)

Description A path traversal and content injection issue exists in the 'JobRunnerBackground.aspx' component. This allows unauthenticated attackers to execute code through simple web requests. The issue leads to full system compromise. The vulnerable component is 'JobRunnerBackground.aspx'. The affected API endpoint is 'JobRunnerBackground.aspx'.

Recommendations Update to DynamicWeb version 9.19.7 or later. Update to DynamicWeb version 9.20.3 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2731

Affected Products

Dynamicweb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2731 · Security Note
• https://t.me/CVEtracker/45089 · Telegram Post
• https://doc.dynamicweb.dev/documentation/fundamentals/dw10release/security-reports.html#january-19th-2026---unauthenticated-rce-dynamicweb-9-and-dynamicweb-8 · Note
• https://twitter.com/0dayPublishing/status/2024380930777911433 · Twitter Post
• https://twitter.com/CVEnew/status/2024501264093212912 · Twitter Post