Skip to main content

Relative Path Traversal

CVE-2025-32017

High
8.8/10

Summary

Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a Path Traversal vulnerability to upload files into a incorrect location. The issue affects both Umbraco.Cms.Api.Management and Umbraco.Cms.Core packages versons 14.0.0-rc1 through 14.3.3 and 15.0.0-rc1 through 15.3.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-23 - Relative Path Traversal

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References

Advisory Timeline

  • Published