Arbitrary file upload in Umbraco Cms
CVE-2025-67288
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. The Supplier also states that PDF JavaScript runs in a completely isolated sandbox, not the browser's DOM context, which means that privilege boundaries would not be crossed, a related issue to CVE-2023-49279.
Vulnerability class: Unrestricted File Upload
EPSS: 0.005 (40.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Umbraco Umbraco_cms — versions 16.3.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-67288?
- CVE-2025-67288 is a critical-severity vulnerability in Umbraco Cms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2025-12-22.
- How severe is CVE-2025-67288?
- Critical severity. CVSS v3 base score is 10.0 out of 10.