{"id":"CVE-2025-32017","aliases":["EUVD-2025-10387","GHSA-q62r-8ppj-xvf4"],"status":"published","title":"Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users","description":"Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00646,"percentile":0.5122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2025-04-08T15:37:23Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"NuGet","package":"Umbraco.Cms","fixed_in":["14.3.4","15.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0--preview004"},{"fixed":"14.3.4"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-rc1"},{"fixed":"15.3.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0--preview004"},{"fixed":"14.3.4"}]}],"versions":["14.0.0","14.0.0-rc1","14.0.0-rc2","14.0.0-rc3","14.0.0-rc4","14.0.0-rc5","14.1.0","14.1.0-rc","14.1.0-rc2","14.1.1","14.1.2","14.2.0","14.2.0-rc","14.2.0-rc2","14.2.0-rc3","14.3.0","14.3.0-rc","14.3.1","14.3.2","14.3.3"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-rc1"},{"fixed":"15.3.1"}]}],"versions":["15.0.0","15.0.0-rc1","15.0.0-rc2","15.0.0-rc3","15.0.0-rc4","15.1.0","15.1.0-rc","15.1.0-rc2","15.1.1","15.1.2","15.2.0","15.2.0-rc","15.2.1","15.2.2","15.2.3","15.3.0","15.3.0-rc","15.3.0-rc2"]}],"products":[{"vendor":"umbraco","product":"umbraco-cms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4","tags":["x_refsource_CONFIRM","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/06a2a500b358ce15b1e228391eb60bd517c6e833","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/d3c1443b14b1076faf13d1bcecc42860fdf5fad8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32017","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q62r-8ppj-xvf4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32017.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-32017","title":"Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users","description":"Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.","status":"published","published":"2025-04-08T15:37:23.733Z","modified":"2025-04-09T17:13:15.314Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-10387","description":"Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.","status":"published","published":"2025-04-08T15:37:23Z","modified":"2025-04-09T17:13:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:38.263259Z"}],"ghsa":[{"id":"GHSA-q62r-8ppj-xvf4","title":"Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users","description":"### Impact\nAuthenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location.\n\n### Patches\nThe issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.\n\n### Workarounds\nUmbraco supports the configuration of [allowed](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#allowed-upload-file-extensions) and [disallowed file extensions](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#disallowed-upload-file-extensions).  Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.","status":"published","published":"2025-04-09T12:49:38Z","modified":"2025-04-09T17:13:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T14:38:38.344711Z"}],"nvd":[{"id":"CVE-2025-32017","description":"Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.","status":"published","published":"2025-04-08T16:15:27.32Z","modified":"2026-06-17T09:11:19.67Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"CVE-2025-32017","title":"Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users","description":"Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.","status":"published","published":"2025-04-08T15:37:23.733Z","modified":"2026-10-28T02:30:55.11538915Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-q62r-8ppj-xvf4","title":"Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users","description":"### Impact\nAuthenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location.\n\n### Patches\nThe issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.\n\n### Workarounds\nUmbraco supports the configuration of [allowed](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#allowed-upload-file-extensions) and [disallowed file extensions](https://docs.umbraco.com/umbraco-cms/reference/configuration/contentsettings#disallowed-upload-file-extensions).  Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.","status":"published","published":"2025-04-09T12:49:38Z","modified":"2025-04-09T17:32:13.162092Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}