Arbitrary File Upload Vulnerability in Umbraco CMS from Umbraco
CVE-2025-67288

10CRITICAL

Key Information:

Vendor

Umbraco

Status
Umbraco CMS
Vendor
CVE Published:
22 December 2025

What is CVE-2025-67288?

An arbitrary file upload vulnerability in Umbraco CMS version 16.3.3 allows malicious users to upload crafted PDF files, enabling them to execute unauthorized code on the server. This exposure can lead to significant security breaches, making it essential for organizations using this CMS to assess their systems and implement immediate mitigation strategies.

References

http://umbraco.com
https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.