UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66625

Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of…

Severity
Medium 4.9
Published
9 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
13.12.1
Sources
NVD

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 10.0.0 before 13.12.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66625
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66625