UpHeron
All vulnerabilities

Servers and applications

CVE-2025-32017

Management API Vulnerability to Path Traversal With Authenticated Users

Severity
High 8.8
Published
8 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
14.3.4, 15.3.1
Also known as
GHSA-q62r-8ppj-xvf4
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 14.0.0 before 14.3.4
  • From 15.0.0 before 15.3.1
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • Every version before 14.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-32017
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-32017
  • GitHub Advisory Database https://github.com/advisories/GHSA-q62r-8ppj-xvf4
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-q62r-8ppj-xvf4