PT-2025-52674 · Umbraco · Umbraco Cms

Vuquyen03 · Published 2025-12-22 · Updated 2026-01-02 · CVE-2025-67288

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 16.3.3

Description An arbitrary file upload issue exists in Umbraco CMS version 16.3.3. Attackers can potentially execute arbitrary code by uploading a specially crafted PDF file. The supplier disputes responsibility, stating file validation is the system administrator's responsibility.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-67288

GHSA-54MJ-VCVJ-Q3V5

Affected Products

Umbraco Cms

References · 17

• 🔥 https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288 · Exploit
• https://osv.dev/vulnerability/CVE-2025-67288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67288 · Security Note
• https://osv.dev/vulnerability/GHSA-54mj-vcvj-q3v5 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://github.com/github/advisory-database/pull/6633 · Note
• https://twitter.com/offseq/status/2003315608142651524 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pttxj6/resumen_diario_de_vulnerabilidades_23122025 · Reddit Post
• https://twitter.com/CveFindCom/status/2003188685487903047 · Twitter Post
• https://t.me/cveNotify/147568 · Telegram Post
• https://twitter.com/CVEnew/status/2003198628467245128 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pw544r/resumen_diario_de_vulnerabilidades_26122025 · Reddit Post
• http://umbraco.com · Note
• https://t.me/cveNotify/147522 · Telegram Post
• https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation · Note