dotCMS Services LLC

dotCMS has fixed 3 critical and high severity vulnerabilities and disclosing them as part of the responsible disclosure program. SI-72 (CVE-2024-4447) permitted users with access to the System Maintenance pane to extract session ID data via the DWR APIs. This could allow high permission users to obfuscate attribution. SI-73 (CVE-2025-8311) resolved a blind SQLi vulnerability in the "/api/v1/contenttype" endpoint that could allow an authenticated, low-privileged user to extract sensitive data or escalate privileges. SI-74 (CVE-2025-11165) addressed a sandbox escape vulnerability in the Velocity scripting engine (VTools) that could enable bypassing class/package restrictions and potential command execution under application privileges. All 3 issues are fixed and merged into dotEvergreen as it always receives the fixes automatically. For customers without dotEvergreen or a supported LTS release, we strongly recommend to use backported versions 25.07.10 LTS or 24.12.27 LTS.

We are pleased to announce that dotCMS has successfully completed its 2025 SOC 2 Type II audit, covering the period from September 1, 2024 to August 31, 2025. Conducted by an independent third-party auditor, the examination validated that our controls operated effectively across 4 Trust Services Criteria for Security, Availability, Confidentiality, and Privacy, with no exceptions noted. This milestone underscores our continued commitment to delivering a secure, reliable, and privacy-first CMS platform for our customers worldwide. At dotCMS is a secure brand that safeguards your data and ensures operational resilience remain top priorities. For reference, the new SOC2 II report is available from the left banner under Resources in our Trust Center at https://security.dotcms.com/

dotCMS security team have completed a fix to security Issue SI-73, which discloses a recently addressed SQLi vulnerability affecting the /api/v1/contenttype endpoint API. The corresponding CVE-2025-8311 (https://www.cve.org/CVERecord?id=CVE-2025-8311), is now live as well. You can find full technical details and mitigation guidance here: 🔗 SI-73 Advisory on dotCMS Please review the advisory and ensure your systems are updated to a patched release if applicable. Let us know if you have any questions or require assistance by contacting security@dotcms.com or your CSM. Thank you dotCMS Security Team

dotCMS is proud to announce that we have achieved ISO/IEC 27001:2022 certification for our Information Security Management System (ISMS). This globally recognized standard affirms our commitment to maintaining the highest level of security, privacy, and risk management across our content management platform. The certification scope includes our Cloud Engineering, Software Development, and Product Support functions, and reflects our ongoing dedication to protecting customer data and maintaining operational excellence. 🔐 Certificate Number: 122254 📅 Valid Until: June 19, 2026 📄 Issued by: Prescient Security LLC

A critical vulnerability (CVE-2025-29927) in Next.js middleware that allows attackers to bypass authorization mechanisms across all versions of the framework. https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Remediation: Upgrade to Next.js v14.1.4 or later Vercel patched the vulnerability in Next.js v14.1.4, so updating your application to at least this version is the primary mitigation.