PT-2026-21673 · Dotcms · Dotcms

Published 2026-02-24 · Updated 2026-03-03 · CVE-2025-11165

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dotCMS (affected versions not specified)

Description A security issue exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and reinitializing its Uberspect, an attacker can remove the introspector.restrict.classes and introspector.restrict.packages protections. Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process. The affected API endpoints and variables are not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-11165

Affected Products

Dotcms

References · 8

• https://osv.dev/vulnerability/CVE-2025-11165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11165 · Security Note
• https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-74 · Vendor Advisory
• https://t.me/CVEtracker/45586 · Telegram Post
• https://twitter.com/CVEnew/status/2026265016324747493 · Twitter Post
• https://t.me/cveNotify/153867 · Telegram Post
• https://t.me/cveNotify/152984 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026233211949396205 · Twitter Post