Arbitrary File Upload in Umbraco CMS 16.3.3 Enables Code Execution

Publication date: 2025-12-22

Last updated on: 2026-07-08

Assigner: MITRE

Description

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. The Supplier also states that PDF JavaScript runs in a completely isolated sandbox, not the browser's DOM context, which means that privilege boundaries would not be crossed, a related issue to CVE-2023-49279.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-22

Last Modified

2026-07-08

Generated

2026-07-28

AI Q&A

2025-12-23

EPSS Evaluated

2026-07-26

NVD

CVE-2025-67288

Affected Vendors & Products

Vendor	Product	Version / Range
umbraco	cms	16.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file upload flaw in Umbraco CMS version 16.3.3 that allows attackers to upload a specially crafted PDF file. By doing so, attackers can execute arbitrary code on the affected system.

Impact Analysis

The vulnerability can lead to full system compromise since attackers can execute arbitrary code remotely without any privileges or user interaction. This can result in complete loss of confidentiality, integrity, and availability of the affected system.

Hi! I’m here to help you understand CVE-2025-67288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70