UpHeron
All vulnerabilities

Servers and applications

CVE-2023-49089

Possible Path traversal when creating packages from backoffice

Severity
Medium 6.5
Published
12 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.18.10, 10.8.1, 12.3.0
Also known as
GHSA-6324-52pr-h4p5
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Versions 8.18.10, 10.8.1, and 12.3.0 contain a patch for this issue.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 8.0.0 before 8.18.10
  • From 10.0.0 before 10.8.1
  • From 12.0.0 before 12.3.0
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 8.0.0 before 8.18.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-49089
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-49089
  • GitHub Advisory Database https://github.com/advisories/GHSA-6324-52pr-h4p5
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6324-52pr-h4p5