Quick answers
- Is CVE-2025-67288 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-67288 being exploited in the wild.
- How severe is CVE-2025-67288?
- Critical severity, with a CVSS score of 10, published 22 December 2025.
- Which products and versions are affected?
- Umbraco.Cms (NuGet) ECOSYSTEM:introduced=0,last_affected=16.3.3.
- Is there a fix for CVE-2025-67288?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-67288 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-67288?
- Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in Umbraco CMS v16.3.3. The flaw allows a remote, unauthenticated attacker to upload a malicious file disguised as a PDF, which can then be executed on the server to achieve remote code execution (RCE). The vulnerability is currently disputed by the vendor, who argues that file validation is a configuration responsibility of the system administrator rather than a defect in the CMS core. This issue is noted as being functionally similar to CVE-2023-49279.
Affected products
- Umbraco Umbraco CMS 16.3.3
Identifiers
- CVE-2025-67288
- GHSA-54mj-vcvj-q3v5
Timeline
- 2025-12-22: disclosed
- 2025-12-22: advisory
- 2026-01-02: other: Vulnerability disputed by vendor