Vulnerability · Published Sep 4, 2025 · Assigned by dotCMS

CVE-2025-8311

Critical 9.4

In plain English

A critical-severity SQL injection in dotCMS Cloud Services (dCS) from dotCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.7%top 22.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys. The vulnerability was triggered via the sites parameter, which was directly concatenated into a SQL query without proper sanitization. Exploitation allowed an authenticated attacker with low privileges to extract data from database, perform privilege escalation, or trigger denial-of-service conditions. The vulnerability was verified using tools such as SQLMap and confirmed to allow full database exfiltration and potential denial-of-service conditions via crafted payloads. The vulnerability is fixed in the following versions of dotCMS stack: 25.08.14 / 25.07.10-1v2 LTS / 24.12.27v10 LTS / 24.04.24v21 LTS

Affected products (as reported)

Vendor	Product	Versions
dotCMS	dotCMS Cloud Services (dCS)	24.03.22+

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-73 vendor-advisory, issue-tracking, related