Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-2731

Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC-FI

Description

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DynamicWeb DynamicWeb 9

Default version status: unknown

  • 8affected
  • 9 to < 9.19.7affected
  • 9.20.0 to < 9.20.3affected
  • 9.21.0unaffected
  • 10unaffected

References