CVE-2025-66625
Medium · 4.9CVSS
4.9
EPSS
0.4%
Published
Dec 9, 2025
CISA due date
—
The record
Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | Umbraco.Cms | 10.0.0 | 13.12.1 |
| nuget | Umbraco.CMS | 10.0.0 | 13.12.1 |
Related vulnerabilities
- GHSA-hfv2-pf68-m33x Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import… Same vulnerability
- GHSA-54mj-vcvj-q3v5 Umbraco CMS has an arbitrary file upload vulnerability Also affects Umbraco.Cms
- CVE-2025-67288 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… Also affects Umbraco.Cms
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200