Snapshot 253288
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Opens in new tab |dotCMS's Trust Center dotCMS dotCMS is the most agile, scalable and secure content management system for enterprise. Built on leading Java technology, dotCMS is an open-source, hybrid multi-tenant headless content management system that gives developers the flexibility of a headless CMS while equipping marketers with no-code visual content authoring. Whether you're building a network of global websites, an employee intranet, customer portal, or single page web application, dotCMS helps you manage content, images, and assets in one centralized location and deliver them to any channel. security@dotcms.com Privacy Policy Compliance ISO/IEC 42001:2023 SOC 2 Type II ISO 27001:2022 TXRAMP Resources View all Compliance ISO 42001:2023 SOC 2 Type II Report - 2026/2027 ISO 27001:2022 Attestation Letters Pentest Letter of Attestation Questionnaires CAIQ QuestionnaireOpens in new tab Policies Policy Handbook Business Continuity Plan Archive SOC2 Type II - 2025/2026 ISO 27001:2022 (2023-2026) Business Continuity Plan (BCP) - 2023 View 3 more Controls View all Infrastructure security Encryption key access restricted Access control procedures established Access revoked upon termination View 9 more Infrastructure security controls Organizational security Asset disposal procedures utilized Employee background checks performed Code of Conduct acknowledged by contractors View 7 more Organizational security controls Product security Control self-assessments conducted Penetration testing performed Vulnerability and system monitoring procedures established Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 27 more Internal security procedures controls Data and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established Data collected Employee personally identifiable information Customer personally identifiable information Credit card information Personal health information Subprocessors View all AWS Cloud Service Provider Google Cloud Platform • Cloud provider Strong DM Single sign-on Keeper Password manager Updates View all Compliance dotCMS Achieves ISO/IEC 27001:2022 Renewal and New ISO/IEC 42001:2023 Certification Published June 19, 2026 dotCMS Services LLC has successfully renewed its ISO/IEC 27001:2022 certification (Information Security Management System) and achieved new ISO/IEC 42001:2023 certification (Artificial Intelligence Management System). ISO/IEC 27001:2022 covers the dotCMS Cloud Services and Evergreen SaaS platform, including Cloud Engineering, Software Development, Product & Customer Support, People, Security, and Leadership. ISO/IEC 42001:2023 covers Artificial Intelligence Management System (AIMS), including internal AI use and the dotAI product feature. Both certifications cover cloud infrastructure on AWS, GCP, Azure, and OVHCloud. Security Security fixes Published March 3, 2026 dotCMS has fixed 3 critical and high severity vulnerabilities and disclosing them as part of the responsible disclosure program. SI-72 (CVE-2024-4447) permitted users with access to the System Maintenance pane to extract session ID data via the DWR APIs. This could allow high permission users to obfuscate attribution. SI-73 (CVE-2025-8311) resolved a blind SQLi vulnerability in the "/api/v1/contenttype" endpoint that could allow an authenticated, low-privileged user to extract sensitive data or escalate privileges. SI-74 (CVE-2025-11165) addressed a sandbox escape vulnerability in the Velocity scripting engine (VTools) that could enable bypassing class/package restrictions and potential command execution under application privileges. All 3 issues are fixed and merged into dotEvergreen as it always receives the fixes automatically. For customers without dotEvergreen or a supported LTS release, we strongly recommend to use backported versions 25.07.10 LTS or 24.12.27 LTS. General dotCMS Achieves 2025 SOC 2 Type II Certification Published September 8, 2025 We are pleased to announce that dotCMS has successfully completed its 2025 SOC 2 Type II audit, covering the period from September 1, 2024 to August 31, 2025. Conducted by an independent third-party auditor, the examination validated that our controls operated effectively across 4 Trust Services Criteria for Security, Availability, Confidentiality, and Privacy, with no exceptions noted. This milestone underscores our continued commitment to delivering a secure, reliable, and privacy-first CMS platform for our customers worldwide. At dotCMS is a secure brand that safeguards your data and ensures operational resilience remain top priorities. For reference, the new SOC2 II report is available from the left banner under Resources in our Trust Center at https://security.dotcms.com/Opens in new tab Security Security Advisory SI-73 and CVE-2025-8311 Now Published Published September 4, 2025 dotCMS security team have completed a fix to security Issue SI-73, which discloses a recently addressed SQLi vulnerability affecting the /api/v1/contenttype endpoint API. The corresponding CVE-2025-8311 (https://www.cve.org/CVERecord?id=CVE-2025-8311Opens in new tab), is now live as well. You can find full technical details and mitigation guidance here: 🔗 SI-73 Advisory on dotCMSOpens in new tab Please review the advisory and ensure your systems are updated to a patched release if applicable. Let us know if you have any questions or require assistance by contacting security@dotcms.com or your CSM. Thank you dotCMS Security Team Media View all The WYSIWYG Field in dotCMS Opens in new tab The WYSWYG (What You See Is What You Get) editor allows you to create content with word processor-like formatting. You can type in text and apply styles to it (make it bold, italic or change the text color for example), insert links and images, and add other content and formatting, with all changes visible in the editor similar to how they will be shown on the front-end site.