Vulnerability Description
Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Cms | >= 14.0.0, < 14.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/umbraco/Umbraco-CMS/commit/06a2a500b358ce15b1e228391eb60bd517Patch
- https://github.com/umbraco/Umbraco-CMS/commit/d3c1443b14b1076faf13d1bcecc42860fdPatch
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4PatchThird Party Advisory
FAQ
What is CVE-2025-32017?
CVE-2025-32017 is a vulnerability with a CVSS score of 8.8 (HIGH). Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to ...
How severe is CVE-2025-32017?
CVE-2025-32017 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-32017?
Check the references section above for vendor advisories and patch information. Affected products include: Umbraco Umbraco Cms.