CVE-2025-66625
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| umbraco | umbraco | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-552 | The product makes files or directories accessible to unauthorized actors, even though they should not be. |
| CWE-377 | Creating and using insecure temporary files can leave application and system data vulnerable to attack. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Umbraco CMS versions 10.0.0 through 13.12.0 involves unsafe handling and deletion of temporary files during the dictionary upload process. An attacker with backoffice access can send predictable requests to temporary file paths and use the application's error responses (HTTP 500 if a file exists, 404 if it does not) to enumerate the existence of arbitrary files on the server's filesystem. Although it does not allow reading or writing file contents, in some configurations, incomplete cleanup of temporary upload files may expose the NTLM hash of the Windows account running the application. The issue is fixed in version 13.12.1.
How can this vulnerability impact me? :
The vulnerability allows an attacker with backoffice access to enumerate files on the server, potentially revealing sensitive information about the server's filesystem. In certain configurations, it may also expose the NTLM hash of the Windows account running Umbraco, which could be used in further attacks such as credential replay or privilege escalation. However, it does not allow direct reading or writing of file contents.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Umbraco to version 13.12.1 or later, as this version contains the fix for the vulnerability involving unsafe handling and deletion of temporary files during the dictionary upload process.