dotCMS allows remote authenticated users to execute arbitrary Java code

MEDIO 6.0CVE-2012-1826 · GHSA-42vg-q6mw-cfh5 · Published 08/06/2012 · updated 16/06/2026

In breve

CVE-2012-1826 è una vulnerabilità MEDIO (CVSS 6.0) che riguarda com.dotcms:dotcms, dotcms (dotcms).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.2%, superiore al 82.2% delle vulnerabilità.
Correzione: aggiornare a 1.9.5.1 o successiva.

Package	Affected versions	Patched versions
com.dotcms:dotcms Maven	`≥ 1.9, < 1.9.5.1`	`1.9.5.1`
dotcms dotcms	`= 1.9= 1.9.2.1`	No fix yet

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

NVD description

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.