Umbraco CMS
CVE-2025-67288
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain backoffice/upload access to Umbraco
-
DeliveryCraft malicious PDF with executable payload
-
ExploitUpload via media handler
-
ExecutionServer stores in executable path
-
PersistRequest uploaded file
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Umbraco administrator has NOT enforced Umbraco's file-upload validation/allow-list - the vendor states this validation is the administrator's responsibility, so a hardened default that blocks dangerous types prevents the attack. The specific prerequisite is the ability to upload a crafted PDF through Umbraco's media/upload functionality (normally an authenticated backoffice capability) AND a server/configuration that permits the uploaded file to be executed or interpreted rather than served as inert static content. Limiting factors: it applies to the specific version 16.3.3 as reported, depends on a non-default/insecure upload configuration, and the published unauthenticated (PR:N) assumption is contested - realistic exploitation more likely needs backoffice access or a misconfiguration exposing the upload path. |
| Impact | The signals conflict sharply. The published CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) implies unauthenticated, network-based, no-interaction RCE with scope change - but Umbraco media/backoffice uploads normally require an authenticated backoffice user, and the vendor dispute asserts the flaw only manifests under an insecure administrator configuration. That makes PR:N and AC:L questionable. EPSS is low (0.50%), there is no CISA KEV listing, and no confirmed weaponized exploit, which is consistent with a contested, config-dependent issue rather than a mass-exploited one. Net: this is likely a HIGH-CVSS-but-lower-real-risk item for default, hardened deployments; real risk concentrates in environments where administrators have relaxed upload restrictions. Verify with the vendor before treating the 10.0 as accurate - the CVSS network/unauth assumptions appear inconsistent with the dispute and with Umbraco's standard authenticated upload flow. |
| Exploit ScenarioDerived | An attacker with (or who obtains) backoffice upload access to a misconfigured Umbraco 16.3.3 instance uploads a crafted PDF whose content or resolved extension is treated as executable by the server, then requests the stored file to trigger code execution in the web application's context. A third-party GitHub repository referencing this CVE may contain proof-of-concept material, but no independently verified working exploit or active exploitation is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Arbitrary code execution in Umbraco CMS 16.3.3 is claimed via upload of a crafted PDF file that abuses insufficient file-type validation (CWE-434), potentially leading to server-side code execution. The finding is explicitly DISPUTED by Umbraco, which states that enforcing upload validation is the deploying administrator's responsibility per documentation, mirroring the earlier CVE-2023-49279. No public exploit is confirmed and EPSS is low (0.50%, 39th percentile), so despite the nominal CVSS 10.0 this reflects a contested, configuration-dependent condition rather than a proven turnkey RCE.
RemediationAI
No vendor-released patch is identified at time of analysis, and Umbraco disputes that a code fix is warranted, framing this as a configuration responsibility. The actionable primary control is to harden Umbraco's upload settings: restrict allowed upload extensions via Umbraco's disallowed/allowed file-type configuration (block executable and script-capable types), ensure the media/upload directory is served with static-only handling so uploaded files cannot be executed by the web server, and confine backoffice upload permissions to trusted users only - trade-off: overly strict allow-lists may block legitimate editor workflows and require content-team coordination. As additional compensating controls, place uploaded content on a separate non-executable path or storage, add a WAF/upload-inspection rule for polyglot/PDF-mismatch content, and monitor the media directory for unexpected file types - noting these add operational overhead and can produce false positives. Track the vendor's guidance and the related CVE-2023-49279 documentation; consult https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288 for the reported technique, and upgrade if Umbraco later publishes a patched release.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in nuget
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Umbraco CMS is a widely used open-source ASP.NET (.NET) content management system whose backoffice media/upload handlers accept files that are later served or processed by the application. The CWE-434 (Unrestricted Upload of File with Dangerous Type) root cause here is that Umbraco, by design, delegates allow-list/deny-list enforcement of uploadable extensions and content validation to the administrator's configuration (e.g., the disallowed file-upload settings) rather than hard-blocking dangerous types itself. The single CPE identified is cpe:2.3:a:umbraco:umbraco_cms:16.3.3, and the reported vector (a 'crafted PDF') implies content that is either mis-typed or processed in a way that yields code execution only when the surrounding environment/config permits it - the same class of dispute raised in the related CVE-2023-49279.
Know when Umbraco Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Upload normally requires an authenticated backoffice user (PR:L) and a non-default insecure config to reach execution (AC:H); successful RCE yields full C/I/A on the host (S:U).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.
Executive ViewAI
Umbraco CMS 16.3.3 has been assigned a critical vulnerability rating for alleged code execution via PDF upload manipulation, though the vendor contests the finding's real-world applicability when standard security practices are followed. No public exploit identified at time of analysis; real-world exploitation likelihood is materially low (EPSS 0.5%) and requires weak administrator configuration to be exploitable.
No vendor-released patch identified at time of analysis. Mitigations: Restrict upload handlers to a whitelist of allowed MIME types and file extensions; disable script execution in all upload directories at the web server level; monitor and log all file uploads for suspicious patterns; consider deploying WAF rules to block files with anomalous headers or payloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
More in Umbraco Cms
View allUmbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package
Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl par
A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. Rated medium severity (CVSS 6.9), thi
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scrip
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, whi
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package f
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" param
Umbraco is a ASP.NET CMS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authenticat
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerabili
A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. Rated medium severity (CVSS 5.4), this vulnerabili
Umbraco is a free and open source .NET content management system. Rated high severity (CVSS 8.8), this vulnerability is
Exploit-DB