High severity7.2NVD Advisory· Published Jul 20, 2017· Updated Jun 17, 2026

CVE-2017-11466

Description

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajax_file_upload. This results in arbitrary code execution by requesting the .jsp file at a /assets URI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dotcms/Dotcms2 versions
cpe:2.3:a:dotcms:dotcms:4.1.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dotcms:dotcms:4.1.1:*:*:*:*:*:*:*
- (no CPE)range: =4.1.1

Patches

Vulnerability mechanics

References

github.com/dotCMS/core/issues/12131nvdIssue TrackingPatchThird Party Advisory
seclists.org/fulldisclosure/2017/Jul/33nvdExploitMailing ListThird Party Advisory
packetstormsecurity.com/files/143383/dotcms411-shell.txtnvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000