GitHub Advisoryadvisory · NuGet

GHSA-fr6r-p8hv-x3c4 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

MEDIUM Published 2025-06-04 Modified 2025-06-04 Official page ↗
Aliases
CVE-2025-48953
Ecosystem
NuGet
Packages
Umbraco.Cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-434
Reviewed
2025-06-04

Affected packages

• NuGet Umbraco.Cms: >= 14.0.0, < 15.4.2 → fixed in 15.4.2

Description

Impact Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions. Patches Patched in 15.4.2 and 16.0.0. Workarounds None available.

Related

Alias · CVE (1)

  • CVE-2025-48953 Umbraco is an ASP.NET content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References