CVE-2025-48953CWE-434

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Medium · published June 3, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-06-03T18:19Z
EPSS history
Timeline
  • 03 JUN 18:19Z
    Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
    cvelistv5