CVE-2012-10054

Description

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.

PUBLISHED Reserved 2025-08-11 | Published 2025-08-13 | Updated 2025-08-14 | Assigner VulnCheck

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Credits

Toby Clarke finder

References

raw.githubusercontent.com/...ows/http/umbraco_upload_aspx.rb exploit

www.exploit-db.com/exploits/19671 exploit

web.archive.org/...a-webmatrix-local-reference-instance.html technical-description exploit

github.com/umbraco/Umbraco-CMS product

web.archive.org/.../umbraco.codeplex.com/releases/view/73692 vendor-advisory patch

www.vulncheck.com/advisories/umbraco-cms-rce third-party-advisory

cve.org (CVE-2012-10054)

nvd.nist.gov (CVE-2012-10054)

Download JSON