CVE-2025-67288

CRITICAL

10.0

Descricao

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.

Detalhes CVE

Pontuacao CVSS v3.110.0

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado12/22/2025

Ultima modificacao1/8/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

umbraco:umbraco_cms

Fraquezas (CWE)

CWE-434

Referencias

http://umbraco.com(cve@mitre.org)

https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288(cve@mitre.org)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.