CVE-2025-67288

The record

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. The Supplier also states that PDF JavaScript runs in a completely isolated sandbox, not the browser's DOM context, which means that privilege boundaries would not be crossed, a related issue to CVE-2023-49279.

Affected packages

Related vulnerabilities

• GHSA-54mj-vcvj-q3v5 Umbraco CMS has an arbitrary file upload vulnerability Same vulnerability
• CVE-2025-66625 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary… Also affects Umbraco.Cms
• GHSA-hfv2-pf68-m33x Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import… Also affects Umbraco.Cms
• CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
• CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
• CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
• CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
• CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434