CVE-2016-3972: dotCMS

Low severity, CVSS 2.7. EPSS: 1.5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.

Affected products

• dotCMS dotCMS: up to and including 3.5

Published 2016-04-18. Last modified 2026-06-17.