Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allows unauthenticated attackers to execute code via simple web requests

According to its self-reported version number, Dynamicweb is 8.x, 9.x prior to 9.19.6 or 9.20.x prior to 9.20.3. It is, therefore, affected by a path traversal and content injection vulnerability in JobRunnerBackground.aspx that allows unauthenticated attackers to execute code via simple web requests.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115736	Dynamicweb 9.20.x < 9.20.3 Unauthenticated Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	critical
115735	Dynamicweb 8.x / 9.x < 9.19.6 Unauthenticated Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2026-2731

critical

Tenable Plugins

critical

critical