PT-2025-23653 · Umbraco · Umbraco

00Mpal00Mpa · Published 2025-06-03 · Updated 2025-06-04 · CVE-2025-48953

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Umbraco versions 14.0.0 through 15.4.1

Description The issue allows uploading a file that does not adhere to the configured allowable file extensions via a manipulated API request. The problem is resolved in versions 15.4.2 and 16.0.0.

Recommendations For versions 14.0.0 through 15.4.1, update to version 15.4.2 or 16.0.0 to resolve the issue. As a temporary workaround, consider restricting API requests to prevent unauthorized file uploads until a patch is applied.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-48953

GHSA-FR6R-P8HV-X3C4

Affected Products

Umbraco

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48953.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4 · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/d920e93d1ee29dc3301697e444f53e8cd5db3cf9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48953 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48953 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fr6r-p8hv-x3c4 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cvetracker/25311 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930036922056839393 · Twitter Post
• https://twitter.com/CVEnew/status/1929974163374059845 · Twitter Post