Executive brief
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
Affected products
- NuGet Umbraco.Cms
Junglewise Threat Intelligence
CVE-2025-48953: Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
CVE-2025-48953 · Severity: low · CVSS 3.1 · Published 2025-06-04
Technologies: Umbraco.Cms (NuGet). Vendors: NuGet.
Related threats
- Umbraco CMS HTML injection in Backoffice confirmation dialog
- Umbraco CMS arbitrary file upload in PDF processing
- Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
- Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
- Umbraco CMS Improper Access Control vulnerability