Umbraco CMS CVE-2025-66625

Requires an authenticated backoffice account with access to the 'Translations' section, which exposes the dictionary import functionality (vendor-stated workaround confirms this is the sole exploitation path). Affected versions are 10.0.0 through 13.12.0. File-existence enumeration works on any hosting platform, but the NTLM-hash exposure is LIMITED to self-hosted Windows deployments running Umbraco under a privileged local or domain account; Umbraco Cloud sites run under low-privilege isolated Azure App Service worker identities and are effectively mitigated. The flaw does not permit reading or writing file contents - only inferring file existence and, conditionally, leaking a credential hash.

This is a genuine-but-moderate issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, 4.9) is internally consistent with the description and the vendor advisory: network-reachable, low complexity, but requiring high privileges (an authenticated backoffice account with access to the Translations section) and yielding confidentiality-only impact with no integrity or availability effect. Multiple signals point to low real-world urgency: EPSS is only 0.36% (28th percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified at time of analysis. There is no conflict between CVSS and the description - both agree the attacker must already be authenticated to the backoffice, so this is a privilege-escalation/post-authentication confidentiality problem rather than a pre-auth RCE. The nuance NVD's 4.9 does not capture is the downstream NTLM-hash exposure: per the GHSA advisory, self-hosted Windows deployments running Umbraco under privileged local or domain accounts could have that account's NTLM hash leaked, enabling relay or offline-crack attacks and potential lateral movement - a materially higher practical risk than the base score suggests. Conversely, Umbraco Cloud installs run under low-privilege isolated Azure App Service identities and are largely mitigated. Net: prioritize patching for self-hosted Windows installs with privileged service accounts; treat as routine for Cloud/low-privilege deployments.

An attacker who already holds (or has phished/compromised) a backoffice account with access to the Translations section initiates a dictionary import and issues predictable requests against the temporary upload file paths, using the differing error responses (HTTP 500 for existing files, 404 for missing) to enumerate arbitrary files on the server. In a self-hosted Windows deployment running under a privileged account, the incomplete temp-file cleanup can additionally leak the service account's NTLM hash, which the attacker captures for offline cracking or relay. No public exploit code is identified at time of analysis.