CVE-2020-6754

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 94.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-05 · updated 2026-06-17
Weakness: CWE-22

Description

dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).

Affected products

dotCMS core: before 5.2.4 — fixed in 5.2.4

How to fix

Upgrade to a fixed version: dotCMS core 5.2.4. Check the vendor advisory for mitigations.

References

https://dotcms.com/security/SI-54
https://github.com/dotCMS/core/issues/17796
https://dotcms.com/security/SI-54
https://github.com/dotCMS/core/issues/17796

Get alerted when CVE-2020-6754 or the next vulnerability affects your stack