GHSA-54mj-vcvj-q3v5
Critical · 10.0CVSS
10.0
EPSS
—
Published
Dec 22, 2025
CISA due date
—
The record
Umbraco CMS has an arbitrary file upload vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | Umbraco.Cms | 0 | No fix |
Related vulnerabilities
- CVE-2025-67288 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… Same vulnerability
- CVE-2025-66625 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary… Also affects Umbraco.Cms
- GHSA-hfv2-pf68-m33x Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import… Also affects Umbraco.Cms
- CVE-2026-8778 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. CWE-434
- CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication… CWE-434
- CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to… CWE-434
- CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. CWE-434
- CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file… CWE-434