CVE-2025-67288

An attacker uploads a crafted file with a PDF extension that contains malicious executable code. The file upload mechanism in Umbraco CMS does not enforce proper validation of file types and content on the platform side — according to the vendor, configuration of this validation is the responsibility of the environment administrator. The uploaded file can then be executed on the server side, leading to RCE.

Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely on the server (RCE), potentially resulting in complete system takeover, data leakage, and compromise of service integrity and availability.

Apply patches available from the vendor according to the references. Regardless of the dispute over responsibility, administrators should implement strict server-side validation of uploaded file types (verification of MIME headers, extensions, and content), restrict file upload permissions exclusively to trusted users, and configure the web server to prevent script execution in directories intended for user files.

Umbraco CMS v16.3.3 (vulnerability reported for this version; vendor disputes its validity)