Riskcovery

CVE-2025-32017

Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

State
Published
Severity
8.8 High
Published
Apr 8, 2025
Updated
Apr 9, 2025
Reserved
Apr 1, 2025

Read the record on cve.org

Description

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-23 Relative Path Traversal

Affected Products

ProductVersions
Umbraco-CMSumbraco
  • >= 14.0.0--preview004, < 14.3.4Affected
  • >= 15.0.0-rc1, < 15.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.