UpHeron
All vulnerabilities

Servers and applications

CVE-2012-10054

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and…

Severity
Critical 9.3
Published
13 Aug 2025
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.7.1
Sources
NVD

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • Every version before 4.7.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2012-10054
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2012-10054