Arbitrary File Upload in Umbraco CMS 16.3.3 Enables Code Execution

Publication date: 2025-12-22

Last updated on: 2026-07-05

Assigner: MITRE

Description

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-22

Last Modified

2026-07-05

Generated

2026-07-06

AI Q&A

2025-12-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67288

Affected Vendors & Products

Vendor	Product	Version / Range
umbraco	cms	16.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to full system compromise since attackers can execute arbitrary code remotely without any privileges or user interaction. This can result in complete loss of confidentiality, integrity, and availability of the affected system.

Executive Summary

This vulnerability is an arbitrary file upload flaw in Umbraco CMS version 16.3.3 that allows attackers to upload a specially crafted PDF file. By doing so, attackers can execute arbitrary code on the affected system.

Hi! I’m here to help you understand CVE-2025-67288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70