CVE-2025-11165: 
dotCMS vulnerability analysis and mitigation

CVE-2025-11165 is a sandbox escape vulnerability in dotCMS's Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions and execute arbitrary system commands. It affects dotCMS LTS versions before 24.12.27 and versions 25.01.07 through before 25.07.10. The vulnerability was published on February 24, 2026, with a patch reference added March 2, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (Red Hat CVE, dotCMS Advisory).

The root cause is an insufficient sandbox enforcement in dotCMS's SecureUberspectorImpl, which is responsible for restricting access to Java classes and packages within the Velocity templating engine. An attacker with scripting privileges can dynamically modify the Velocity engine's runtime configuration and reinitialize its Uberspect component, effectively removing the introspector.restrict.classes and introspector.restrict.packages protections. Once these restrictions are cleared, the attacker gains unrestricted access to arbitrary Java classes — including java.lang.Runtime — enabling execution of arbitrary OS commands under the privileges of the dotCMS or Tomcat application process. The vulnerability is classified under CWE-89 per NVD mapping, though the actual mechanism is more accurately a sandbox escape via improper access control in a scripting engine (dotCMS Advisory, Red Hat CVE).

Successful exploitation allows an authenticated attacker to achieve full system compromise, executing arbitrary commands with the privileges of the dotCMS or Tomcat process. This can result in unauthorized access to sensitive data, modification or destruction of system files, and potential lateral movement to other systems on the network. The CVSS v3.1 scope is marked as "Changed," reflecting that the impact extends beyond the vulnerable component itself to the underlying host system (Red Hat CVE, dotCMS Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (dotCMS Advisory). The EPSS score is approximately 0.047%, indicating a currently low probability of exploitation in the near term. The vulnerability requires authenticated access with scripting privileges, which limits the attack surface compared to unauthenticated vulnerabilities. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest available data.

1. Reconnaissance: Identify a dotCMS instance running an affected LTS version (before 24.12.27 or between 25.01.07 and before 25.07.10) and obtain or compromise credentials for an account with Velocity scripting privileges.
2. Access the scripting interface: Log in to the dotCMS administrative interface and navigate to a feature that allows Velocity template execution (e.g., content templates, macros, or VTL scripts).
3. Modify Velocity runtime configuration: Craft a malicious Velocity script that accesses the Velocity engine's runtime configuration object and dynamically removes or clears the introspector.restrict.classes and introspector.restrict.packages properties.
4. Reinitialize the Uberspect: Trigger a reinitialization of the Velocity engine's Uberspect component (e.g., by calling the appropriate runtime API methods within the script), causing SecureUberspectorImpl to reload without the class/package restrictions.
5. Access java.lang.Runtime: With restrictions removed, craft a follow-up Velocity script that directly instantiates or accesses java.lang.Runtime or similar privileged Java classes.
6. Execute arbitrary commands: Use the Runtime.exec() method or equivalent to execute OS-level commands under the dotCMS/Tomcat process account, enabling data exfiltration, reverse shell establishment, or further lateral movement (dotCMS Advisory).

• Logs: dotCMS or Tomcat application logs showing Velocity template execution that references runtime configuration modification methods or Uberspect reinitialization; unexpected Java reflection or class-loading events in application logs.
• Logs: Access logs showing authenticated users submitting unusually complex or obfuscated Velocity scripts to template or macro endpoints.
• Process: Unexpected child processes spawned by the Tomcat/dotCMS JVM process (e.g., /bin/sh, cmd.exe, curl, wget, nc) that are not part of normal application behavior.
• Network: Outbound connections from the dotCMS/Tomcat server to unknown external IP addresses or domains, particularly on non-standard ports, potentially indicating reverse shell or data exfiltration activity.
• File System: New or modified files in the dotCMS installation directory, web root, or Tomcat directories created by the application process account, including web shells or unauthorized scripts.

Upgrade dotCMS to version 24.12.27 or later (for the 24.x LTS branch) or to version 25.07.10 or later (for the 25.x LTS branch) (dotCMS Advisory). As interim mitigations, restrict Velocity scripting privileges to only highly trusted users and audit existing accounts with scripting access. Implement network segmentation around the dotCMS server to limit the blast radius of potential command execution. Monitor application logs for anomalous Velocity script submissions or unexpected process spawning.

The vulnerability was tracked by ENISA's European Vulnerability Database (EUVD-2025-207542) and referenced by Red Hat's security advisory portal shortly after disclosure (Red Hat CVE). A technical write-up was published by Infinit Security covering the sandbox escape mechanics (Infinit Security). No significant social media controversy or broad community debate has been observed beyond standard vulnerability tracking and aggregation.