CVE-2025-66625

MEDIUM EPSS 21.7%
Published Dec 9, 20256mo ago · Modified Jun 17, 20261w ago
4.9 CVSS 3.1
Medium
Find Similar
Published Dec 9, 2025 6mo ago
Last Modified Jun 17, 2026 1w ago

Description

Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. This issue is fixed in version 13.12.1.

CVSS Details

Base Score
4.9
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
21.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-377
CWE-552

Affected Products 1

VendorProductVersionRange
umbracoumbraco_cms*≥10.0.0  –  <13.12.1

References 2

  • github.com https://github.com/umbraco/Umbraco-CMS/commit/7505efd433189037f46547932d4a8b603fd4a615
    Patch
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hfv2-pf68-m33x
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/umbraco/Umbraco-CMS/commit/7505efd433189037f46547932d4a8b603fd4a615
    Patch
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hfv2-pf68-m33x
    PatchThird Party Advisory