GitHub Advisoryadvisory · NuGet

GHSA-54mj-vcvj-q3v5 Umbraco CMS has an arbitrary file upload vulnerability

MEDIUM Published 2025-12-22 Modified 2026-01-22 Official page ↗
Aliases
CVE-2025-67288
Ecosystem
NuGet
Packages
Umbraco.Cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434, CWE-79
Reviewed
2025-12-22

Affected packages

• NuGet Umbraco.Cms: <= 16.3.3 (no fix yet)

Description

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file. While Umbraco provides hooks to perform file validation, it does not do implement filtering by default. Users are expected to implement their own validation. Note: This vulnerability is disputed by Ubraco.

Related

Alias · CVE (1)

  • CVE-2025-67288 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References