CVE-2025-48953: Umbraco CMS Path Traversal Vulnerability

CVE-2025-48953 Overview

CVE-2025-48953 is an unrestricted file upload vulnerability [CWE-434] in Umbraco CMS, an ASP.NET content management system. The flaw affects versions 14.0.0 through 15.4.1 and allows authenticated users to upload files bypassing the configured allowable file extensions through a manipulated API request. The issue results from improper validation of file extensions in the IsFileAllowedForUpload extension method within ContentSettingsExtensions.cs. Umbraco released fixes in versions 15.4.2 and 16.0.0.

Critical Impact
Authenticated attackers can upload files with disallowed extensions by manipulating API requests, potentially staging malicious content on the server and bypassing content governance controls.

Affected Products

Umbraco CMS versions 14.0.0 through 15.4.1
Umbraco CMS 16.0.0 release candidates prior to GA
All deployments using default ContentSettings extension filtering

Discovery Timeline

2025-06-03 - CVE-2025-48953 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48953

Vulnerability Analysis

The vulnerability lives in the IsFileAllowedForUpload extension method in src/Umbraco.Core/Configuration/ContentSettingsExtensions.cs. This method evaluates whether a file extension passes the allow list or deny list defined in ContentSettings. Attackers craft API requests that supply extensions with surrounding whitespace or other manipulations that bypass the string comparison. The server accepts the file because the manipulated extension does not match any entry in the configured allow or deny lists.

The impact depends on how the uploaded file is later served or processed. In environments where media is rendered through the CMS pipeline, uploaded files can enable cross-site scripting, host malicious payloads for secondary delivery, or circumvent organizational content policies.

Root Cause

The original comparison logic performed InvariantEquals against the raw extension string without normalizing whitespace. An attacker-supplied extension such as " exe" or "exe " fails to match the deny entry "exe", so the method returns true and the upload proceeds. The fix trims the extension before comparison.

Attack Vector

Exploitation requires low-privilege authentication and user interaction. An authenticated backoffice user issues a POST request to the media upload API with a file whose extension string includes padding characters that evade the filter. The scope changes to the broader web application because stored files become accessible through the public-facing site.

csharp

// Patch: src/Umbraco.Core/Configuration/ContentSettingsExtensions.cs
// Before (vulnerable):
public static bool IsFileAllowedForUpload(this ContentSettings contentSettings, string extension) =>
    contentSettings.AllowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension)) ||
    (contentSettings.AllowedUploadedFileExtensions.Any() == false &&
     contentSettings.DisallowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension)) == false);

// After (patched):
public static bool IsFileAllowedForUpload(this ContentSettings contentSettings, string extension)
    => contentSettings.AllowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension.Trim())) ||
    (contentSettings.AllowedUploadedFileExtensions.Any() == false &&
     contentSettings.DisallowedUploadedFileExtensions.Any(x => x.InvariantEquals(extension.Trim())) == false);

Source: Umbraco-CMS commit d920e93

Detection Methods for CVE-2025-48953

Indicators of Compromise

Media files in the wwwroot/media directory with extensions not present in the configured AllowedUploadedFileExtensions or matching the DisallowedUploadedFileExtensions list.
API requests to Umbraco media endpoints containing filenames with trailing or leading whitespace characters before the extension.
Unexpected content types served from the /media/ URL path such as .exe, .aspx, .ashx, or .svg payloads.

Detection Strategies

Audit uploaded media filenames against the configured allow and deny lists after normalizing whitespace in extensions.
Enable web server logging on media upload endpoints and alert on filename patterns containing non-standard characters adjacent to the extension.
Review Umbraco audit logs for upload events performed by low-privilege backoffice accounts.

Monitoring Recommendations

Monitor the Umbraco media storage directory for new files with executable or script extensions.
Track HTTP POST requests to /umbraco/management/api/v*/media endpoints and flag payloads with unusual Content-Disposition filename values.
Correlate upload events with subsequent GET requests to the same media URL to identify active exploitation attempts.

How to Mitigate CVE-2025-48953

Immediate Actions Required

Upgrade Umbraco CMS to version 15.4.2, 16.0.0, or later.
Review the media library for files uploaded since deployment of version 14.0.0 and quarantine any file whose extension does not match the sanitized allow list.
Restrict backoffice user permissions so that only trusted editors can access media upload functionality.

Patch Information

Umbraco released the fix in commit d920e93d1ee29dc3301697e444f53e8cd5db3cf9, included in versions 15.4.2 and 16.0.0. The patch applies .Trim() to the extension string before comparison against the allow and deny lists. See the GitHub Security Advisory GHSA-fr6r-p8hv-x3c4 for the official vendor disclosure.

Workarounds

No vendor-supplied workarounds are available. Upgrading to a patched version is the only supported remediation.
As a compensating control, place a reverse proxy or web application firewall rule in front of the Umbraco media upload endpoint to reject multipart requests whose filename contains whitespace adjacent to the extension.

bash

# Verify Umbraco version from the deployed binaries
dotnet list package | grep -i Umbraco.Cms

# Upgrade to the patched release
dotnet add package Umbraco.Cms --version 15.4.2