PT-2025-50229 · Umbraco · Umbraco

Published 2025-12-09 · Updated 2026-01-02 · CVE-2025-66625

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 10.0.0 through 13.12.0

Description Umbraco, an ASP.NET CMS, experiences an issue related to the unsafe handling and deletion of temporary files during the dictionary upload process. An attacker with backoffice access can leverage predictable requests to temporary file paths to enumerate the existence of arbitrary files on the server’s filesystem by observing differing error responses (HTTP 500 or 404). This does not permit reading or writing file contents. In specific configurations, incomplete cleanup of temporary upload files may reveal the NTLM hash of the Windows account running the Umbraco application.

Recommendations Update to Umbraco version 13.12.1.

Exploit

Fix

Files Accessible to External Parties

Information Disclosure

Weakness Enumeration

CWE-552

CWE-377

CWE-200

Related Identifiers

CVE-2025-66625

GHSA-HFV2-PF68-M33X

Affected Products

Umbraco

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66625.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/commit/7505efd433189037f46547932d4a8b603fd4a615 · Patch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hfv2-pf68-m33x · Patch
• https://osv.dev/vulnerability/CVE-2025-66625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66625 · Security Note
• https://twitter.com/CVEnew/status/1998732820504891432 · Twitter Post
• https://t.me/cveNotify/147630 · Telegram Post