CVE-2017-3188: The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal

Security readout for executives and security teams

CVE-2017-3188 affects dotCMS 3.7.1 and earlier Enterprise Pro Push Publishing. A malicious bundle archive can place files outside the intended directory during extraction, potentially leading to arbitrary file writes and command execution as the dotCMS application user. Exposure is likely limited to organizations running dotCMS administration panel 3.7.1 or earlier with Enterprise Pro Push Publishing enabled or reachable by administrators. Treat as urgent for legacy dotCMS environments because successful exploitation may compromise the server under the application account. Priority is lower only if no affected version or Push Publishing exposure exists. Mitigation focus: Identify any dotCMS 3.7.1 or earlier Enterprise Pro deployments.; Check dotCMS vendor guidance for fixed versions or supported upgrade paths.; Restrict access to the dotCMS administrator panel while assessing exposure..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.