# CVE-2025-67288: Umbraco CMS arbitrary file upload in PDF processing

Source: https://junglewise.ai/threats/cve-2025-67288-umbraco-cms-arbitrary-file-upload-in-pdf-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-22. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-67288 · Severity: critical · CVSS 10 · Published 2025-12-22

Umbraco CMS, a popular platform for managing website content, contains a vulnerability that could allow an attacker to take full control of the web server. By uploading a specially crafted PDF file, an unauthorized user may be able to execute malicious code, potentially leading to data theft or service disruption. The software provider disputes this report, stating that administrators are responsible for configuring proper file upload restrictions within the system.

Technologies: [Umbraco.Cms (NuGet)](https://junglewise.ai/threats/technologies/umbraco-cms). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2025-67288 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67288 being exploited in the wild.

**How severe is CVE-2025-67288?** Critical severity, with a CVSS score of 10, published 22 December 2025.

**Which products and versions are affected?** Umbraco.Cms (NuGet) ECOSYSTEM:introduced=0,last_affected=16.3.3.

**Is there a fix for CVE-2025-67288?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-67288 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-67288?** Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability (CWE-434) exists in Umbraco CMS v16.3.3. The flaw allows a remote, unauthenticated attacker to upload a malicious file disguised as a PDF, which can then be executed on the server to achieve remote code execution (RCE). The vulnerability is currently disputed by the vendor, who argues that file validation is a configuration responsibility of the system administrator rather than a defect in the CMS core. This issue is noted as being functionally similar to CVE-2023-49279.

## Affected products

- Umbraco Umbraco CMS 16.3.3

## Identifiers

- CVE-2025-67288
- GHSA-54mj-vcvj-q3v5

## Timeline

- 2025-12-22: disclosed
- 2025-12-22: advisory
- 2026-01-02: other: Vulnerability disputed by vendor

## References

- [https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288](https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288)

## Related threats

- [Umbraco Delivery API authorization bypass in content reference expansion](https://junglewise.ai/threats/cve-2026-69197-umbraco-delivery-api-authorization-bypass-in-content-reference)
- [Umbraco CMS open redirect in member Surface Controllers](https://junglewise.ai/threats/cve-2026-46616-umbraco-cms-open-redirect-in-member-surface-controllers)
- [Umbraco CMS HTML injection in Backoffice confirmation dialog](https://junglewise.ai/threats/cve-2026-46609-umbraco-cms-html-injection-in-backoffice-confirmation-dialog)
- [Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks](https://junglewise.ai/threats/cve-2026-31834-umbraco-affected-by-vertical-privilege-escalation-via-missing)
- [Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering](https://junglewise.ai/threats/cve-2026-31833-umbraco-has-stored-xss-in-ufm-rendering-pipeline-via-permissive)