What is the CVSS score of CVE-2025-67288?

CVE-2025-67288 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Umbraco CMS are affected by CVE-2025-67288?

Umbraco CMS 16.3.3 has been assigned a critical vulnerability rating for alleged code execution via PDF upload manipulation, though the vendor contests the finding's real-world applicability when…

How to fix or mitigate CVE-2025-67288?

Within 24 hours: Inventory Umbraco CMS deployments and audit their file upload validation configurations. Within 7 days: Enforce mandatory MIME-type and file-extension validation at the application layer; disable execution permissions on upload directories; implement WAF filtering for anomalous file uploads if feasible. Within 30 days: Subscribe to Umbraco security updates and establish a configuration review cadence to prevent similar misconfigurations.

Umbraco CMS CVE-2025-67288

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-12-22 cve@mitre.org

RCE File Upload Umbraco Cms

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Upload normally requires an authenticated backoffice user (PR:L) and a non-default insecure config to reach execution (AC:H); successful RCE yields full C/I/A on the host (S:U).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 14:32 vuln.today

DescriptionNVD

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.

AnalysisAI

Arbitrary code execution in Umbraco CMS 16.3.3 is claimed via upload of a crafted PDF file that abuses insufficient file-type validation (CWE-434), potentially leading to server-side code execution. The finding is explicitly DISPUTED by Umbraco, which states that enforcing upload validation is the deploying administrator's responsibility per documentation, mirroring the earlier CVE-2023-49279. No public exploit is confirmed and EPSS is low (0.50%, 39th percentile), so despite the nominal CVSS 10.0 this reflects a contested, configuration-dependent condition rather than a proven turnkey RCE.

Technical ContextAI

Umbraco CMS is a widely used open-source ASP.NET (.NET) content management system whose backoffice media/upload handlers accept files that are later served or processed by the application. The CWE-434 (Unrestricted Upload of File with Dangerous Type) root cause here is that Umbraco, by design, delegates allow-list/deny-list enforcement of uploadable extensions and content validation to the administrator's configuration (e.g., the disallowed file-upload settings) rather than hard-blocking dangerous types itself. The single CPE identified is cpe:2.3:a:umbraco:umbraco_cms:16.3.3, and the reported vector (a 'crafted PDF') implies content that is either mis-typed or processed in a way that yields code execution only when the surrounding environment/config permits it - the same class of dispute raised in the related CVE-2023-49279.

RemediationAI

No vendor-released patch is identified at time of analysis, and Umbraco disputes that a code fix is warranted, framing this as a configuration responsibility. The actionable primary control is to harden Umbraco's upload settings: restrict allowed upload extensions via Umbraco's disallowed/allowed file-type configuration (block executable and script-capable types), ensure the media/upload directory is served with static-only handling so uploaded files cannot be executed by the web server, and confine backoffice upload permissions to trusted users only - trade-off: overly strict allow-lists may block legitimate editor workflows and require content-team coordination. As additional compensating controls, place uploaded content on a separate non-executable path or storage, add a WAF/upload-inspection rule for polyglot/PDF-mismatch content, and monitor the media directory for unexpected file types - noting these add operational overhead and can produce false positives. Track the vendor's guidance and the related CVE-2023-49279 documentation; consult https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288 for the reported technique, and upgrade if Umbraco later publishes a patched release.