GitHub Advisoryadvisory · NuGet

GHSA-q62r-8ppj-xvf4 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

HIGH Published 2025-04-09 Modified 2025-04-09 Official page ↗
Aliases
CVE-2025-32017
Ecosystem
NuGet
Packages
Umbraco.Cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-23
Reviewed
2025-04-09

Affected packages

• NuGet Umbraco.Cms: >= 14.0.0--preview004, < 14.3.4 → fixed in 14.3.4 • NuGet Umbraco.Cms: >= 15.0.0-rc1, < 15.3.1 → fixed in 15.3.1

Description

Impact Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. Patches The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1. Workarounds Umbraco supports the configuration of allowed and disallowed file extensions. Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-32017 Umbraco is a free and open source .NET content management system. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References