CVE-2026-10072

Executive Summary

CVE-2026-10072 is a High-severity Arbitrary File Upload vulnerability (CVSS 8.6) in DreamMaker, a web application development framework by Interinfo. The flaw allows any authenticated user with privileged (admin-level) access to upload malicious files—specifically web shells—to the target server, resulting in arbitrary code execution with the privileges of the web server process. This vulnerability is particularly dangerous in environments where DreamMaker is used to build customer-facing portals or internal business applications, as it effectively grants remote attackers a foothold for full server compromise, lateral movement, and data exfiltration. Per vendor advisory, the issue is remediated in Java Composer version 2.3 or later, though patch confirmation is limited to a single CNA claim.

Technical Analysis

CVE-2026-10072 stems from a lack of proper validation and restriction on file uploads processed by DreamMaker's file-handling components. The underlying flaw resides in the server-side code responsible for accepting multipart/form-data requests. When a privileged user submits a file-upload request, the application fails to enforce an allowlist of acceptable file extensions or MIME types, nor does it sanitize the filename or validate the file's actual content before persisting it to disk.

Specifically, the upload endpoint accepts a filename parameter and a binary payload. The server concatenates the filename with a configured upload directory (often /uploads/ or /resources/ under the web root) without stripping dangerous characters or rejecting executable extensions such as .jsp, .jspx, .war, or .php. Because DreamMaker uses Java Composer as its underlying runtime, the primary payloads of interest are Java Server Pages (.jsp) files, which the embedded application server (e.g., Apache Tomcat) will compile and execute on the next HTTP request.

The attack vector is complexity-low: the attacker needs only a valid privileged account. No CSRF protection bypass is required if the attacker can directly craft HTTP requests (e.g., via Burp Suite or cURL). The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), which is a well-understood weakness class. The CVSS vector reflects network access, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

The affected component is the file-upload servlet or controller mapped to endpoints such as /upload, /file/upload, or /attachment/save. In vulnerable versions (prior to 2.3), this endpoint trusts the client-supplied filename and writes the file to a path discoverable via directory enumeration or a predictable URL scheme.

Exploitation Scenarios

This vulnerability requires an authenticated attacker with a privileged role (e.g., administrator or content manager). The following is a realistic, step-by-step attack chain:

1. Reconnaissance and Access: The attacker identifies a target running DreamMaker. They use Shodan or Google dorks (http.title:"DreamMaker", inurl:dreammaker) to find exposed instances. They then obtain valid credentials through phishing, credential stuffing (taking advantage of weak defaults), or purchasing access from an initial-access broker. Alternatively, if the application has a registration flow that grants elevated roles, they may abuse that.

2. Trigger/Weaponization: After logging in with the privileged account, the attacker navigates to a functional area that accepts file uploads—typically a content management module, theme uploader, or file manager. Using Burp Suite, they intercept the upload request. The request resembles:

   POST /upload HTTP/1.1
   Host: target.com
   Cookie: JSESSIONID=...
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="shell.jsp"
   Content-Type: application/octet-stream
   
   <% Runtime.getRuntime().exec(request.getParameter("cmd")); %>
   ------WebKitFormBoundary--
   

   The server-side code does not validate the .jsp extension or the file's MIME type, so it accepts the payload.

3. Payload Execution: The server writes shell.jsp to a predictable directory under the web root, e.g., /uploads/shell.jsp. The attacker then sends an HTTP GET request to https://target.com/uploads/shell.jsp?cmd=whoami. The embedded Java application server compiles the JSP on-the-fly and executes the command, returning the output in the HTTP response.

   GET /uploads/shell.jsp?cmd=id HTTP/1.1
   Host: target.com
   

4. Post-Exploitation: With a functional web shell, the attacker escalates privileges (attempting to break out of the web container's JVM to the underlying OS), uploads additional tools (e.g., a reverse shell, Mimikatz for credential harvesting, or a cryptominer), establishes persistence via cron jobs or SSH keys, and moves laterally to databases and other internal systems reachable from the compromised host.

The entire chain, from login to web shell execution, takes under five minutes. The lack of a public PoC does not hinder exploitation; the JSP payload is trivial to write and the attack mechanics are standard.

Impact Assessment

The business impact of CVE-2026-10072 is severe for organizations relying on DreamMaker. A successful exploit results in:

• Confidentiality Breach: Attackers gain read access to any file the web server user can read—including configuration files with database credentials, application source code, and sensitive business data.
• Integrity Compromise: Attackers can modify or delete application files, deface the portal, or tamper with business logic.
• Availability Disruption: Full server compromise can lead to ransomware deployment, which was the observed pattern in similar file-upload exploits across other Java-based platforms.
• Lateral Movement: The compromised host often sits in a trusted network segment, enabling pivoting to internal systems, ERP databases, and domain controllers.
• Compliance Violations: If the server processes PII, PHI, or cardholder data, a breach could trigger regulatory fines (GDPR, HIPAA, PCI-DSS) and contractual penalties.

The CVSS base score of 8.6 (High) reflects the significant but privilege-constrained nature of the attack. The EPSS score of 0.00456 (37.3rd percentile) suggests low current exploitation activity, but this figure can climb rapidly once proof-of-concept code circulates in private channels or threat actor forums. The organizational blast radius is high: a single DreamMaker instance often underpins multiple related applications, and the framework is used in enterprise portals that aggregate data from multiple backends.

Detection Guidance

Sigma Rule

title: Suspicious JSP File Upload to DreamMaker Endpoint
id: 7f3b6c2a-8d4e-4f5a-9b1c-3d2e4f5a6b7c
status: experimental
description: Detects upload of JSP or executable files to DreamMaker file-upload endpoints, indicative of CVE-2026-10072 exploitation.
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - '/upload'
      - '/file/upload'
      - '/attachment/save'
    cs-filename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.php'
  condition: selection
level: high
tags:
  - attack.t1190
  - cve.2026.10072

YARA Rule

rule CVE_2026_10072_DreamMaker_WebShell
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects JSP web shell payloads targeting DreamMaker arbitrary file upload"
        cve = "CVE-2026-10072"
        date = "2026-02-10"
    strings:
        $jsp_open = "<%" ascii wide
        $runtime_exec = "Runtime.getRuntime().exec" ascii wide
        $process_builder = "ProcessBuilder" ascii wide
        $cmd_param = "getParameter(\"cmd\")" ascii wide
        $garbage = "GarbageCollector" ascii wide nocase
    condition:
        uint16(0) == 0x3C25 or // starts with "<%"  (JSP)
        ($jsp_open at 0) and
        (any of ($runtime_exec, $process_builder) or $cmd_param) and
        filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2026-10072 DreamMaker JSP WebShell Upload"; flow:established,to_server; content:"filename=\""; http_client_body; content:".jsp"; http_client_body; nocase; content:"<%"; http_client_body; pcre:"/filename=\"[^\"]+\.(?:jsp|jspx|war)\"/i"; pcre:"/Runtime\.getRuntime\(\)\.exec|ProcessBuilder/"; appids:"jsp"; classtype:attempted-admin; sid:2026100721; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where event.category == "network" and
    destination.port == 443 and
    http.request.method == "POST" and
    url.path in ("/upload", "/file/upload", "/attachment/save") ]
  [ file where event.action in ("create", "rename") and
    file.extension in ("jsp", "jspx", "war") and
    process.name in ("java", "tomcat", "catalina") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND (uri_path IN ("/upload", "/file/upload", "/attachment/save"))
| rex field=uri_query "filename=(?<filename>[^&]+)"
| eval file_ext=lower(trim(mvindex(split(filename, "."), -1)))
| where file_ext IN ("jsp", "jspx", "war", "php")
| stats count by src_ip, uri_path, filename, user_agent
| sort - count

Wazuh OSSEC Rule

<rule id="100721" level="12">
  <decoded>apache-accesslog</decoded>
  <field name="method">POST</field>
  <field name="url" type="pcre2">(?:/upload|/file/upload|/attachment/save)</field>
  <description>CVE-2026-10072: Suspicious JSP upload to DreamMaker endpoint from $(srcip)</description>
  <group>attack.t1190, cve.2026.10072,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Restrict access to the file-upload functionality to only trusted, known IP ranges via firewall or WAF rules.
   • Implement a WAF rule to block requests where the filename parameter ends in .jsp, .jspx, .war, .php, or other executable extensions.
   • Disable JSP compilation in the underlying application server if DreamMaker's core functionality does not require it (e.g., set org.apache.jasper.compiler.disable in Tomcat to true as a stopgap).
   • Audit existing upload directories for suspicious .jsp or .war files; quarantine and remove any found web shells.
   • Enforce strict role-based access control (RBAC)—revoke admin privileges from any account not actively needing them.

2. Patch/Upgrade Steps:

   • Upgrade DreamMaker's underlying runtime to Java Composer version 2.3 or later, as specified in the vendor advisory.
   • Verify the patch integrity by checking the vendor's official distribution channel (Interinfo support portal) and comparing file hashes.
   • After patching, re-test the upload functionality to confirm that executable file extensions are rejected and that the fix does not break legitimate uploads (e.g., images, PDFs).
   • Because patch confirmation is based on a single source, maintain heightened monitoring even after patching until independent validation is published.

3. Long-Term Hardening:

   • Apply the principle of least privilege: separate content-management roles from system administration roles.
   • Store all uploaded files outside the web root in a dedicated volume, and serve them via a static-file handler that enforces a strict MIME-type allowlist.
   • Implement a file-upload validation layer (server-side) that checks both extension and file magic bytes, regardless of the framework.
   • Harden the underlying application server (Tomcat/Java) per CIS benchmarks, ensuring the web container runs under a non-privileged OS account.
   • Subscribe to Interinfo's security advisories and monitor CVE feeds for follow-up disclosures or public exploit code.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-10072
2. CNA Advisory (TWNCERT/Interinfo): https://www.twcert.org.tw/en/cp-139-XXXXX-YYYYY.html (pending retrieval)
3. CWE-434 Reference: https://cwe.mitre.org/data/definitions/434.html
4. ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
5. CISA KEV: Not listed (as of report date); however, given the EPSS percentile and the exploitability of the class, monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog for future additions.

Threat Actor Activity: No specific threat actor campaigns or in-the-wild exploitation have been publicly confirmed at the time of writing. The absence of public PoC and KEV listing suggests limited active exploitation; however, web-shell-on-Java-platform attacks are a favored technique among APT groups (e.g., those targeting Asian government and enterprise tech sectors), and this CVE should be treated as a high-priority hardening item regardless.