CVE-2025-11165 is a critical (9.9) sandbox escape in the Velocity scripting engine of dotCMS. Authenticated users with scripting privileges can remove class and package restrictions and run system commands. dotCMS tracks it as known security issue SI-74, so check that entry for fixed versions.
What's affected
The record lists dotCMS. The affected feature is the Velocity scripting engine, known as VTools, where a class named SecureUberspectorImpl enforces class and package restrictions. The record says an authenticated user with scripting privileges can change the runtime configuration and reinitialize the engine so the restrictions introspector.restrict.classes and introspector.restrict.packages are removed. After that, arbitrary Java classes can be reached, including java.lang.Runtime, and system commands run with the privileges of the application process, such as the dotCMS or Tomcat user.
The CVSS vector is AV:N/AC:L/PR:L/UI:N with scope changed. The record does not give affected or fixed version numbers. The page I tried to read, the dotCMS known security issues entry SI-74, did not load its details for me, so confirm the versions on the dotCMS site.
How to check if you're exposed
Check who can script and which version you run.
- Find your dotCMS version in the admin console.
- Read known security issue SI-74 at the dotCMS site and compare the affected and fixed versions with yours.
- List users and roles that have scripting privileges, including API tokens attached to those users.
- Check the application and Tomcat logs for unusual Velocity activity and unexpected child processes on the host.
What to do now
- Open SI-74 on the dotCMS known security issues page and note the fixed releases.
- Upgrade dotCMS to a fixed release, or apply the remediation the page describes.
- Reduce scripting privileges to the smallest set of trusted users, and review which API tokens carry them.
- Run dotCMS and Tomcat as an unprivileged user with limited outbound network access and file rights.
- Review recent content and template changes for code you did not write.
Why it matters
The record lists CWE-89, SQL injection, but the description reads as a sandbox escape that leads to code execution. The label and the narrative do not match, so use the description when you assess your risk.
Template engines that allow scripting depend on a restriction layer to keep scripts inside a safe set of classes. If a script can change the settings of that layer, it can switch the protection off. The lesson is that a sandbox must not be configurable from inside itself. Reduce the number of people who hold scripting rights, because for them the sandbox is a thin barrier.
Quick check
Who can exploit it?
The record says authenticated users with scripting privileges. That is why limiting scripting rights is a main control.
Sources
Last reviewed: 19 October 2026.
