CVE-2025-48953
MEDIUM5.5EPSS 0.19%Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Published: 6/4/2025Modified: 6/5/2025
Description
### Impact Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions. ### Patches Patched in 15.4.2 and 16.0.0. ### Workarounds None available.
Affected packages (1)
- NuGet/Umbraco.Cms>= 14.0.0, < 15.4.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L |