CVE-2025-32017
Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Impact
### Impact Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. ### Patches The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1. ### Workarounds Umbraco supports the configuration of [allowed](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#allowed-upload-file-extensions) and [disallowed file extensions](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#disallowed-upload-file-extensions). Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms | >= 14.0.0--preview004, < 14.3.4 | 14.3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | from 14.0.0 before 14.3.4 from 15.0.0 before 15.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/umbraco/Umbraco-CMS/commit/06a2a500b358ce15b1e228391eb60bd517c6e833
- https://github.com/umbraco/Umbraco-CMS/commit/d3c1443b14b1076faf13d1bcecc42860fdf5fad8
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4
- https://github.com/advisories/GHSA-q62r-8ppj-xvf4
- https://nvd.nist.gov/vuln/detail/CVE-2025-32017