CVE-2025-11165

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11165", "assignerOrgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "state": "PUBLISHED", "assignerShortName": "dotCMS", "dateReserved": "2025-09-29T16:47:07.465Z", "datePublished": "2026-02-24T08:27:07.579Z", "dateUpdated": "2026-02-24T14:35:53.768Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.dotcms.com/", "defaultStatus": "unaffected", "product": "dotCMS", "vendor": "dotCMS", "versions": [{"status": "affected", "version": "24.12"}, {"status": "affected", "version": "25.07"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>A sandbox escape vulnerability exists in dotCMS\u2019s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.</p><p>By dynamically modifying the Velocity engine\u2019s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.</p><p>Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).</p><p></p>"}], "value": "A sandbox escape vulnerability exists in dotCMS\u2019s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.\n\nBy dynamically modifying the Velocity engine\u2019s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.\n\nOnce these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user)."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "shortName": "dotCMS", "dateUpdated": "2026-02-24T08:27:07.579Z"}, "references": [{"name": "dotCMS Known Security Issues - SI-74", "url": "https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-74"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T14:32:17.342754Z", "id": "CVE-2025-11165", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T14:35:53.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11165", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-24T14:32:17.342754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T14:32:21.864Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}, {"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "dotCMS", "product": "dotCMS", "versions": [{"status": "affected", "version": "24.12"}, {"status": "affected", "version": "25.07"}], "collectionURL": "https://www.dotcms.com/", "defaultStatus": "unaffected"}], "references": [{"url": "https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-74", "name": "dotCMS Known Security Issues - SI-74"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in dotCMS\u2019s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.\n\nBy dynamically modifying the Velocity engine\u2019s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.\n\nOnce these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).", "supportingMedia": [{"type": "text/html", "value": "<p></p><p>A sandbox escape vulnerability exists in dotCMS\u2019s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.</p><p>By dynamically modifying the Velocity engine\u2019s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.</p><p>Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "shortName": "dotCMS", "dateUpdated": "2026-02-24T08:27:07.579Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11165", "state": "PUBLISHED", "dateUpdated": "2026-02-24T14:35:53.768Z", "dateReserved": "2025-09-29T16:47:07.465Z", "assignerOrgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "datePublished": "2026-02-24T08:27:07.579Z", "assignerShortName": "dotCMS"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.dotcms.com/", "defaultStatus": "unaffected", "product": "dotCMS", "vendor": "dotCMS", "versions": [{"status": "affected", "version": "24.12"}, {"status": "affected", "version": "25.07"}]}], "source": "security@dotcms.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dotcms:dotcms:*:*:*:*:lts:*:*:*", "matchCriteriaId": "AD4EEDE0-960F-4C87-A84F-E8E8229D8586", "versionEndExcluding": "24.12.27", "vulnerable": true}, {"criteria": "cpe:2.3:a:dotcms:dotcms:*:*:*:*:lts:*:*:*", "matchCriteriaId": "A131EBAE-C515-4776-BD40-771AB4F40CBB", "versionEndExcluding": "25.07.10", "versionStartIncluding": "25.01.07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in dotCMS\u2019s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.\n\nBy dynamically modifying the Velocity engine\u2019s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.\n\nOnce these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user)."}, {"lang": "es", "value": "Hay una vulnerabilidad de escape de sandbox en el motor de scripting Velocity de dotCMS (VTools) que permite a usuarios autenticados con privilegios de scripting eludir las restricciones de clase y paquete impuestas por SecureUberspectorImpl.\n\nAl modificar din\u00e1micamente la configuraci\u00f3n en tiempo de ejecuci\u00f3n del motor Velocity y reinicializar su Uberspect, un actor malicioso puede eliminar las protecciones introspector.restrict.classes e introspector.restrict.packages.\n\nUna vez que se eliminan estas restricciones, el atacante puede acceder a clases Java arbitrarias, incluyendo java.lang.Runtime, y ejecutar comandos de sistema arbitrarios bajo los privilegios del proceso de la aplicaci\u00f3n (p. ej., usuario de dotCMS o Tomcat)."}], "id": "CVE-2025-11165", "lastModified": "2026-06-17T08:29:47.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@dotcms.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11165", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T14:32:17.342754Z", "version": "2.0.3"}}]}, "published": "2026-02-24T09:16:12.310", "references": [{"source": "security@dotcms.com", "tags": ["Vendor Advisory"], "url": "https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-74"}], "sourceIdentifier": "security@dotcms.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@dotcms.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "24.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "25.07"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dotCMS", "source": "cna", "vendor": "dotCMS"}, "product": "dotcms", "vendor": "dotcms"}], "created": "2026-02-25T11:45:04.786400+00:00", "updated": "2026-02-25T11:45:04.786506+00:00", "vendors": ["dotcms", "dotcms$PRODUCT$dotcms"]}