CVE-2025-67288 | THREATINT

Description

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.

PUBLISHED Reserved 2025-12-08 | Published 2025-12-22 | Updated 2026-01-08 | Assigner mitre

References

umbraco.com

github.com/vuquyen03/CVE/tree/main/CVE-2025-67288

cve.org (CVE-2025-67288)

nvd.nist.gov (CVE-2025-67288)

Download JSON