UpHeron
All vulnerabilities

Servers and applications

CVE-2025-48953

Possibility to By-Pass Configured Allowed Extensions for File Uploads

Severity
Medium 6.5
Published
3 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
15.4.2
Also known as
GHSA-fr6r-p8hv-x3c4
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 14.0.0 before 15.4.2
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 14.0.0 before 15.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-48953
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-48953
  • GitHub Advisory Database https://github.com/advisories/GHSA-fr6r-p8hv-x3c4
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4