medium6.5Public exploit code
CVE-2020-5811
Authenticated path traversal in Umbraco CMS
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Umbraco CMS 8.9.1 - Directory Traversal2021-08-31 · webapps · aspx
Impact
An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | UmbracoCms | < 8.9.2 | 8.9.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | through 8.9.1 |